Docker daemon.json generator

What it does

It writes /etc/docker/daemon.json, the file dockerd reads at start, for a Linux server: log rotation so container logs cannot fill the disk, address pools that keep Docker's networks away from your LAN and VPN, live-restore, the storage driver, registry mirrors and the metrics endpoint. Each key is explained and the page gives the commands that apply it safely.

How it works

1. The file is written in your browser by @anaroq/linux, the engine behind our other Linux tools. Keys you do not set are left out, so Docker keeps its own default for them.
2. A value dockerd would refuse, such as a pool that is not a range, overlapping pools or a mirror with a path, is refused next to the field instead of being written.
3. The same files pass dockerd --validate in our tests, which loads a configuration exactly as the daemon does at start.

What each key does

log-driver and log-opts

Where container output goes, and when its file is rotated: max-size per file, max-file files kept. Without them json-file logs grow until the disk is full.

storage-driver

How image layers are stored. overlay2 is Docker's documented default; changing it on a server that has data hides existing images and containers.

default-address-pools

The ranges Docker carves networks from: base is the pool, size the prefix of each network. They replace the built-in 172.17–172.31 and 192.168 pools.

bip

The address of the default docker0 bridge with its prefix. Keeping it outside the pools leaves the pools whole for your networks.

registry-mirrors

Pull-through caches for Docker Hub images. Docker tries them in order and falls back to Docker Hub.

live-restore

Containers keep running while dockerd is down for a restart or an upgrade. Not compatible with Swarm mode.

metrics-addr

Serves Prometheus metrics of the daemon at /metrics, without authentication. Keep it on 127.0.0.1 unless your monitoring server needs it.

Example

A server with rotated logs, pools in 10.210.0.0/16 and the bridge in 10.209.0.0/24, live-restore, a Docker Hub mirror and metrics on loopback:

{
  "log-driver": "json-file",
  "log-opts": {
    "max-size": "10m",
    "max-file": "3"
  },
  "storage-driver": "overlay2",
  "default-address-pools": [
    {
      "base": "10.210.0.0/16",
      "size": 24
    }
  ],
  "bip": "10.209.0.1/24",
  "registry-mirrors": [
    "https://mirror.gcr.io"
  ],
  "live-restore": true,
  "metrics-addr": "127.0.0.1:9323"
}

[ ! -f /etc/docker/daemon.json ] || sudo cp -p /etc/docker/daemon.json /etc/docker/daemon.json.bak
sudo install -m 0644 -D daemon.json /etc/docker/daemon.json
sudo dockerd --validate --config-file /etc/docker/daemon.json
sudo systemctl restart docker
docker info --format '{{.LoggingDriver}} {{.Driver}} live-restore={{.LiveRestoreEnabled}}'
docker info --format '{{range .RegistryConfig.Mirrors}}{{println .}}{{end}}'
docker network create anaroq-pool-test
docker network inspect --format '{{range .IPAM.Config}}{{.Subnet}}{{end}}' anaroq-pool-test
docker network rm anaroq-pool-test
curl -s http://127.0.0.1:9323/metrics | head -n 5

Limits

• Linux servers running Docker Engine. Docker Desktop and rootless Docker read their settings elsewhere and are not covered.
• It writes a new file. Merge it by hand with keys you already have (insecure-registries, data-root, dns…), or they are lost.
• Address pools apply to networks created after the restart: existing networks keep their ranges until you remove and recreate them.
• IPv6 pools, TLS for the API socket and per-container log settings are not covered.

Not sure which ranges collide? Check your LAN and VPN against Docker's networks

Sources

1. dockerd: daemon configuration file
2. Docker Engine: configure logging drivers
3. Docker Engine: live restore
4. Docker Engine: storage drivers
5. Docker Engine: collect metrics with Prometheus

Related

• Docker subnet conflict checker
• Docker Compose Generator
• cloud-init Generator for Ubuntu 24.04
• Production readiness checklist

Next step

Docker subnet conflict checker