# CL-0014: Logging Driver Disabled

**Severity:** MEDIUM

**References:**
- [Docker logging drivers](https://docs.docker.com/engine/logging/configure/) — `none` driver disables collection
- [OWASP Logging Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Logging_Cheat_Sheet.html)

## What it detects

Services with `logging.driver` set to `none`. Services using any other driver (e.g., `json-file`, `syslog`, `fluentd`) or services without explicit logging configuration are not flagged.

## Why it matters

`logging.driver: none` discards the container's stdout/stderr at the daemon — `docker logs`, log shippers reading the JSON-file driver, and any centralized aggregator that relies on the runtime see nothing. Application-level logging that writes to a file or remote endpoint is unaffected, but the runtime-level forensic data source is gone. During an incident, anything the workload only emitted on stdout is lost.

This is a forensic gap, not a non-repudiation guarantee — runtime logs are not authenticated or tamper-evident regardless. The cost of recovery during an investigation is the actual harm.

## Fix

Remove `driver: none` to use the default logging driver, or configure an appropriate one:

```yaml
# Before
services:
  app:
    image: myapp:1.0
    logging:
      driver: none

# After
services:
  app:
    image: myapp:1.0
    logging:
      driver: json-file
      options:
        max-size: 10m
        max-file: '3'
```

For centralized logging, use `syslog`, `fluentd`, or `gelf` drivers with appropriate endpoints.
