chore(docker): cap the container log size of every production service

artifacts/docs/README.md

@@ -16,7 +16,7 @@ Services: adminer, cloudflared, portainer, portainer-agent, postgraphile, postgr
 
 ### event-streaming
 
-Services: debezium, debezium-postgres-connector, postgres, redpanda, redpanda-console, sqitch, traefik
+Services: debezium, debezium-postgres-connector, postgres, redpanda, redpanda-cluster-config, redpanda-console, sqitch, traefik
 
 ### recommendation
 
@@ -144,6 +144,10 @@ You cannot access the caching system via a web interface.
 
 You can access the event streaming platform's ui as described under `redpanda-console`.
 
+### redpanda-cluster-config
+
+The broker's one-shot task for adjusting its cluster configuration after startup.
+
 ### redpanda-console
 
 You can access the event streaming platform's ui at [redpanda.app.localhost](https://redpanda.app.localhost/).

src/development/redpanda/compose.yaml

@@ -21,6 +21,18 @@ services:
     image: redpandadata/redpanda:v26.2.5
     volumes:
       - redpanda-data:/var/lib/redpanda/data
+  redpanda-cluster-config:
+    # The broker's one-shot task for adjusting its cluster configuration after startup.
+    command: /entrypoint.sh
+    deploy:
+      labels:
+        - dargstack.profiles=event-streaming
+      restart_policy:
+        condition: on-failure
+    entrypoint: sh
+    image: curlimages/curl:8.22.0
+    volumes:
+      - ./configurations/cluster-config.sh:/entrypoint.sh:ro
   redpanda-console:
     # You can access the event streaming platform's ui at [redpanda.app.localhost](https://redpanda.app.localhost/).
     deploy:

src/development/redpanda/configurations/cluster-config.sh

@@ -0,0 +1,21 @@
+#!/bin/sh
+set -eu
+
+ADMIN_URL="http://redpanda:9644/v1/cluster_config"
+
+# Wait for Redpanda's admin API to be reachable.
+echo "Waiting for Redpanda to be ready..."
+while ! curl --output /dev/null --silent "$ADMIN_URL"; do
+    sleep 5
+done
+
+# The continuous balancing features are licensed enterprise features,
+# and the cluster runs on the community edition.
+# Disabling both keeps the broker on its unlicensed properties.
+echo "Disabling the unlicensed enterprise balancing features..."
+curl --fail --output /dev/null --silent --show-error \
+    -X PUT "$ADMIN_URL" \
+    -H "Content-Type: application/json" \
+    -d '{"config_properties": {"core_balancing_continuous": false, "partition_auto_balancing_continuous": false}}'
+
+echo "The enterprise balancing features are disabled."

src/production/adminer/compose.yaml

@@ -9,3 +9,8 @@ services:
           - node.labels.vibetype.storage == true
       update_config:
         order: start-first
+    logging:
+      driver: json-file
+      options:
+        max-file: "3"
+        max-size: 20m

src/production/cadvisor/compose.yaml

@@ -6,3 +6,8 @@ services:
         - traefik.http.routers.cadvisor-secure.tls.certresolver=default
       update_config:
         order: start-first
+    logging:
+      driver: json-file
+      options:
+        max-file: "3"
+        max-size: 20m

src/production/cloudflared/compose.yaml

@@ -24,5 +24,10 @@ services:
       retries: 3
       start_period: 30s
     image: cloudflare/cloudflared:2026.10.2
+    logging:
+      driver: json-file
+      options:
+        max-file: "3"
+        max-size: 20m
     secrets:
       - cloudflared-tunnel-token

src/production/debezium/compose.yaml

@@ -6,6 +6,11 @@ services:
           - node.labels.vibetype.storage == true
       update_config:
         order: stop-first
+    logging:
+      driver: json-file
+      options:
+        max-file: "3"
+        max-size: 20m
   debezium-postgres-connector:
     deploy:
       placement:

src/production/elasticsearch/compose.yaml

@@ -6,3 +6,8 @@ services:
           - node.labels.vibetype.storage == true
       update_config:
         order: stop-first
+    logging:
+      driver: json-file
+      options:
+        max-file: "3"
+        max-size: 20m

src/production/geoip/compose.yaml

@@ -3,3 +3,8 @@ services:
     deploy:
       update_config:
         order: start-first
+    logging:
+      driver: json-file
+      options:
+        max-file: "3"
+        max-size: 20m

src/production/grafana/compose.yaml

@@ -9,3 +9,8 @@ services:
           - node.labels.vibetype.storage == true
       update_config:
         order: start-first
+    logging:
+      driver: json-file
+      options:
+        max-file: "3"
+        max-size: 20m

src/production/jobber/compose.yaml

@@ -8,6 +8,11 @@ services:
         order: stop-first
     environment:
       SENTRY_CRONS: ${SENTRY_CRONS}
+    logging:
+      driver: json-file
+      options:
+        max-file: "3"
+        max-size: 20m
     volumes:
       - (( append ))
       - postgres-backup-data:/backups/

src/production/memcached/compose.yaml

@@ -3,3 +3,8 @@ services:
     deploy:
       update_config:
         order: start-first
+    logging:
+      driver: json-file
+      options:
+        max-file: "3"
+        max-size: 20m

src/production/node-exporter/compose.yaml

@@ -3,3 +3,8 @@ services:
     deploy:
       update_config:
         order: start-first
+    logging:
+      driver: json-file
+      options:
+        max-file: "3"
+        max-size: 20m

src/production/portainer-agent/compose.yaml

@@ -3,3 +3,8 @@ services:
     deploy:
       update_config:
         order: start-first
+    logging:
+      driver: json-file
+      options:
+        max-file: "3"
+        max-size: 20m

src/production/portainer/compose.yaml

@@ -10,3 +10,8 @@ services:
           - node.labels.vibetype.storage == true
       update_config:
         order: stop-first
+    logging:
+      driver: json-file
+      options:
+        max-file: "3"
+        max-size: 20m

src/production/postgraphile/compose.yaml

@@ -8,3 +8,8 @@ services:
       update_config:
         order: start-first
     image: ghcr.io/maevsi/postgraphile:2.3.1
+    logging:
+      driver: json-file
+      options:
+        max-file: "3"
+        max-size: 20m

src/production/postgres/compose.yaml

@@ -10,6 +10,11 @@ services:
           - node.labels.vibetype.storage == true
       update_config:
         order: stop-first
+    logging:
+      driver: json-file
+      options:
+        max-file: "3"
+        max-size: 20m
   postgres-backup:
     # You cannot access the database backup directly.
     deploy:
@@ -24,6 +29,11 @@ services:
       POSTGRES_PASSWORD_FILE: /run/secrets/postgres-password
       POSTGRES_USER_FILE: /run/secrets/postgres-user
     image: prodrigestivill/postgres-backup-local:18-alpine
+    logging:
+      driver: json-file
+      options:
+        max-file: "3"
+        max-size: 20m
     secrets:
       - postgres-backup-db
       - postgres-password

src/production/prometheus/compose.yaml

@@ -9,3 +9,8 @@ services:
           - node.labels.vibetype.storage == true
       update_config:
         order: stop-first
+    logging:
+      driver: json-file
+      options:
+        max-file: "3"
+        max-size: 20m

src/production/reccoom/compose.yaml

@@ -6,13 +6,23 @@ services:
     environment:
       SENTRY_TRACES_SAMPLE_RATE: "0.1"
     image: ghcr.io/maevsi/reccoom:0.23.0
+    logging:
+      driver: json-file
+      options:
+        max-file: "3"
+        max-size: 20m
   reccoom-consumer:
     deploy:
       update_config:
         order: start-first
     environment:
       SENTRY_TRACES_SAMPLE_RATE: "0.1"
     image: ghcr.io/maevsi/reccoom:0.23.0
+    logging:
+      driver: json-file
+      options:
+        max-file: "3"
+        max-size: 20m
   reccoom-migration:
     deploy:
       update_config:
@@ -27,3 +37,8 @@ services:
           - node.labels.vibetype.storage == true
       update_config:
         order: stop-first
+    logging:
+      driver: json-file
+      options:
+        max-file: "3"
+        max-size: 20m

src/production/redis/compose.yaml

@@ -6,3 +6,8 @@ services:
           - node.labels.vibetype.storage == true
       update_config:
         order: stop-first
+    logging:
+      driver: json-file
+      options:
+        max-file: "3"
+        max-size: 20m

src/production/redpanda/compose.yaml

@@ -6,6 +6,18 @@ services:
           - node.labels.vibetype.storage == true
       update_config:
         order: stop-first
+    logging:
+      driver: json-file
+      options:
+        max-file: "3"
+        max-size: 20m
+  redpanda-cluster-config:
+    deploy:
+      placement:
+        constraints:
+          - node.labels.vibetype.storage == true
+      update_config:
+        order: stop-first
   redpanda-console:
     deploy:
       labels:
@@ -16,3 +28,8 @@ services:
           - node.labels.vibetype.storage == true
       update_config:
         order: start-first
+    logging:
+      driver: json-file
+      options:
+        max-file: "3"
+        max-size: 20m

src/production/traefik/compose.yaml

@@ -25,6 +25,11 @@ services:
     environment:
       CF_DNS_API_TOKEN_FILE: /run/secrets/traefik-cf-dns-api-token
       CF_ZONE_API_TOKEN_FILE: /run/secrets/traefik-cf-zone-api-token
+    logging:
+      driver: json-file
+      options:
+        max-file: "3"
+        max-size: 20m
     secrets:
       - traefik-cf-dns-api-token
       - traefik-cf-zone-api-token
@@ -51,6 +56,11 @@ services:
     environment:
       STACK_DOMAIN: ${STACK_DOMAIN}
     image: ldez/traefik-certs-dumper:v2.11.4
+    logging:
+      driver: json-file
+      options:
+        max-file: "3"
+        max-size: 20m
     volumes:
       - acme-data:/etc/traefik/acme/
 volumes:

src/production/tusd/compose.yaml

@@ -7,3 +7,8 @@ services:
         - traefik.http.routers.tusd-secure.tls.certresolver=default
       update_config:
         order: start-first
+    logging:
+      driver: json-file
+      options:
+        max-file: "3"
+        max-size: 20m

src/production/vibetype/compose.yaml

@@ -8,6 +8,11 @@ services:
       update_config:
         order: start-first
     image: ghcr.io/maevsi/vibetype:15.25.1
+    logging:
+      driver: json-file
+      options:
+        max-file: "3"
+        max-size: 20m
   # vibetype-beta:
   #   # You can access the main project frontend's beta version at [beta.app.localhost](https://beta.app.localhost/).
   #   deploy:

src/production/zammad/compose.yaml

@@ -6,6 +6,11 @@ services:
           - node.labels.vibetype.storage == true
       update_config:
         order: stop-first
+    logging:
+      driver: json-file
+      options:
+        max-file: "3"
+        max-size: 20m
   zammad-init:
     deploy:
       placement:
@@ -23,24 +28,44 @@ services:
           - node.labels.vibetype.storage == true
       update_config:
         order: start-first
+    logging:
+      driver: json-file
+      options:
+        max-file: "3"
+        max-size: 20m
   zammad-railsserver:
     deploy:
       placement:
         constraints:
           - node.labels.vibetype.storage == true
       update_config:
         order: start-first
+    logging:
+      driver: json-file
+      options:
+        max-file: "3"
+        max-size: 20m
   zammad-scheduler:
     deploy:
       placement:
         constraints:
           - node.labels.vibetype.storage == true
       update_config:
         order: stop-first
+    logging:
+      driver: json-file
+      options:
+        max-file: "3"
+        max-size: 20m
   zammad-websocket:
     deploy:
       placement:
         constraints:
           - node.labels.vibetype.storage == true
       update_config:
         order: start-first
+    logging:
+      driver: json-file
+      options:
+        max-file: "3"
+        max-size: 20m