This is less of a deep dive and more an illustration of the worst way to use containers.

Having /var/log set as as a persistent volume would have worked, but ultimately they were using "docker commit" to amend/update their images which is definitely the wrong way to do it.