fix(compose): route container logs to journald to bound disk usage (#2853)

* fix(compose): route container logs to journald to bound disk usage

Adds `logging: driver: journald` to all four services in
docker-compose.yml.tmpl with per-service tags so the host's
systemd-journald handles rotation/retention. Previously the default
json-file driver wrote unbounded `*-json.log` files under
/var/lib/docker/containers/, which on long-running Pi installs could
fill the SD card (issue #2304 reported a 19 GB anthias-viewer log).

Updates the docs to explain the new behavior and document `journalctl`
access via the per-service `CONTAINER_TAG=` filter.

Refs #2304

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix: cover anthias-caddy with journald driver, scope docs accurately

Address Copilot review on #2853:
- enable_ssl.sh's generated SSL override added anthias-caddy without a
  logging block, so the caddy sidecar would still write unbounded
  json-file logs. Add the journald driver + tag there too.
- Docs implied no Anthias container writes json-file logs, which was
  not true once SSL was enabled. Scope the statement to the four core
  services plus the optional caddy sidecar.
- Lead the journalctl examples with sudo (always works) and add a note
  explaining when the installer-granted adm group lets you drop sudo.

Refs #2304

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* docs: document one-time cleanup of pre-existing json-file logs

Address Copilot review on #2853: the journald switch only affects
future writes, so devices upgrading from the old json-file driver
still have the historical *-json.log files on disk and need to
reclaim that space manually. Add a note + a safe truncate command
(deleting while docker has the file open is unsafe; truncate -s 0
zeroes them in place).

Refs #2304

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: vpetersson

bin/enable_ssl.sh

@@ -201,6 +201,10 @@ EOF
     cat <<'EOF'
       - anthias-caddy-data:/data
       - anthias-caddy-config:/config
+    logging:
+      driver: journald
+      options:
+        tag: anthias-caddy
 
 volumes:
   anthias-caddy-data:

docker-compose.yml.tmpl

@@ -29,6 +29,10 @@ services:
       - /etc/localtime:/etc/localtime:ro
     labels:
       io.balena.features.supervisor-api: '1'
+    logging:
+      driver: journald
+      options:
+        tag: anthias-server
 
   anthias-viewer:
     image: ghcr.io/screenly/anthias-viewer:${DOCKER_TAG}-${DEVICE_TYPE}
@@ -55,6 +59,10 @@ services:
       - /etc/localtime:/etc/localtime:ro
     labels:
       io.balena.features.supervisor-api: '1'
+    logging:
+      driver: journald
+      options:
+        tag: anthias-viewer
 
   anthias-celery:
     # Runs on the same image as anthias-server with a CMD override.
@@ -94,6 +102,10 @@ services:
       - /etc/localtime:/etc/localtime:ro
     labels:
       io.balena.features.supervisor-api: '1'
+    logging:
+      driver: journald
+      options:
+        tag: anthias-celery
 
   redis:
     image: ghcr.io/screenly/anthias-redis:${DOCKER_TAG}-${DEVICE_TYPE}
@@ -105,6 +117,10 @@ services:
     restart: always
     volumes:
       - redis-data:/var/lib/redis
+    logging:
+      driver: journald
+      options:
+        tag: anthias-redis
 
 volumes:
   resin-data:

website/content/docs/_index.md

@@ -12,9 +12,27 @@ and `raspberrypi` for the hostname, then run:
 $ ssh pi@raspberrypi
 ```
 
-Anthias makes use of Docker for containerization. To get the logs from the
-containers, you can either make use of the `docker logs` command or you can
-use the `docker compose logs` command.
+Anthias ships its container logs through the host's `systemd-journald`,
+so the system handles rotation and retention for you. The four core
+services (`anthias-server`, `anthias-viewer`, `anthias-celery`, `redis`)
+plus the optional `anthias-caddy` TLS sidecar all use the journald
+driver, so they don't write the unbounded `*-json.log` files under
+`/var/lib/docker/containers/` that can fill an SD card on long-running
+installs. You can read the logs three ways: `docker logs`,
+`docker compose logs`, or `journalctl` directly.
+
+> **Note**
+>
+> Switching the driver only affects future writes. Devices that were
+> on the old `json-file` driver will still have the existing log files
+> on disk after upgrading. To reclaim that space, truncate the leftover
+> files in place (Docker keeps them open, so deleting can confuse the
+> daemon — `truncate -s 0` is safe):
+>
+> ```bash
+> $ sudo find /var/lib/docker/containers/ -name "*-json.log" \
+>     -exec truncate -s 0 {} +
+> ```
 
 ### Using `docker logs`
 
@@ -59,6 +77,39 @@ $ docker compose logs -f ${SERVICE_NAME}
 
 Check out [this section](/docs/development/#understanding-the-components-that-make-up-anthias) of the Developer documentation page for the list of available services.
 
+### Using `journalctl`
+
+Each service is tagged in the journal so you can pull logs without
+docker. Useful when you want to grep across a long time range or
+combine container logs with system logs:
+
+```bash
+$ sudo journalctl -f CONTAINER_TAG=anthias-server
+$ sudo journalctl --since "1 hour ago" CONTAINER_TAG=anthias-viewer
+```
+
+The available tags are `anthias-server`, `anthias-viewer`,
+`anthias-celery`, `anthias-redis`, and (when TLS is enabled)
+`anthias-caddy`.
+
+> **Note**
+>
+> The Anthias installer adds your user to the `adm` group, which on
+> Debian/Raspberry Pi OS grants read access to the journal once you've
+> logged out and back in (and provided the journal is persistent —
+> i.e. `/var/log/journal/` exists). On systems where that's set up you
+> can drop the `sudo` from the commands above.
+
+Journal retention is controlled by `systemd-journald` (see
+`/etc/systemd/journald.conf` — `SystemMaxUse` caps total disk usage,
+defaulting to 10% of the filesystem). If you want to free space
+immediately:
+
+```bash
+$ sudo journalctl --vacuum-time=2d   # drop entries older than 2 days
+$ sudo journalctl --vacuum-size=200M # cap journal at 200 MB
+```
+
 ## Enabling SSH
 
 See [the official documentation](https://www.raspberrypi.org/documentation/remote-access/ssh/)