Moby is the iconic open source runtime that packages applications and dependencies into lightweight, portable containers. Understanding where Moby lives on your system helps you manage images, containers, and configuration with confidence.
Below is a quick reference table summarizing key runtime paths, configuration locations, and log storage for the Moby environment.
| Component | Typical Path (Linux) | Windows Equivalent | Purpose |
|---|---|---|---|
| Unix socket | /var/run/docker.sock | Npipe via named pipe | API communication between client and daemon |
| Daemon configuration | /etc/docker/daemon.json | C:\ProgramData\docker\config\daemon.json | Persistent daemon settings and features |
| Images and layers | /var/lib/docker/image/ | C:\ProgramData\docker\image | Stored image manifests, layer metadata, and IDs |
| Container writable layers | /var/lib/docker/containers/{id}/ | C:\ProgramData\docker\containers\{id} | Container config, hostname, hosts, resolv.conf |
| Container logs | /var/lib/docker/containers/{id}/{id}-json.log | C:\ProgramData\docker\containers\{id}\{id}-json.log | stdout and stderr output in JSON line format |
Moby Engine Daemon and Runtime Location
Unix Socket and API Endpoint
The Moby engine exposes its API through a Unix domain socket at /var/run/docker.sock on Linux. This socket is the primary channel for Docker CLI commands to reach the daemon. On Windows, the equivalent is an npipe binding that maps to a named pipe provided by the Moby service.
Daemon Configuration File
The main daemon configuration file lives at /etc/docker/daemon.json and controls features such as insecure registries, storage drivers, and network settings. On Windows hosts, the file is located at C:\ProgramData\docker\config\daemon.json and is applied when the service starts.
Images, Containers, and Storage Paths
Image and Layer Storage
All images and their constituent layers are stored under /var/lib/docker/image on Linux, with metadata indexed by storage driver. Windows installations keep these files at C:\ProgramData\docker\image, where each configured driver maintains its own directory structure.
Container Configuration and State
Per-container directories under /var/lib/docker/containers hold hostnames, hosts file entries, resolver configurations, and restart policies. On Windows, these files are found at C:\ProgramData\docker\containers\{id}, ensuring that container-specific settings remain isolated and reproducible.
Logging, Volumes, and Network Data
Container Logs and Retention
Standard output and error streams are written to JSON log files at /var/lib/docker/containers/{id}/{id}-json.log on Linux, and to the equivalent path under C:\ProgramData\docker\containers on Windows. Log rotation settings in daemon.json help control disk usage over time.
Volumes and Network Customization
Persistent volumes may reside outside the default graph root, and their mount points are recorded in container configuration files. Network bridge settings, custom networks, and DNS configurations are typically stored within the local Docker state directory and managed by the embedded container network plugin.
Key Takeaways and Recommendations
- Keep daemon.json in /etc/docker or its Windows equivalent for consistent configuration management.
- Monitor /var/lib/docker or its Windows counterpart to prevent storage driver space pressure.
- Use log rotation policies to avoid oversized container log files filling disk space.
- Back up important images and volumes separately from the runtime state when performing upgrades.
- Document any custom graph-root or network configurations to simplify troubleshooting and migrations.
FAQ
Reader questions
Where is the Moby daemon configuration stored on Linux and Windows?
On Linux, the daemon configuration is located at /etc/docker/daemon.json. On Windows, the equivalent path is C:\ProgramData\docker\config\daemon.json.
What socket does the Moby API use, and where can I find it?
The Moby API is exposed via a Unix socket at /var/run/docker.sock on Linux, and via a named pipe on Windows when the daemon is running as a service.
Where are container logs written by default?
Container logs are written as JSON lines to /var/lib/docker/containers/{id}/{id}-json.log on Linux, and to C:\ProgramData\docker\containers\{id}\{id}-json.log on Windows.
How do I change the default image and container storage location?
You can relocate the storage root by specifying the graph directory in daemon.json using the data-root option, then restarting the Moby service so it initializes the new path.