Where logs should go: file, journal, or stdout

One service's logs can appear in three places: /var/log/app.log, journalctl -u app, and container stdout. Writing twice wastes disk and makes you read the wrong file during an incident.

Principles: containers write to stdout and stderr and let the runtime collect; do not run logrotate inside the image. systemd services can write to stderr and journald adds the unit, PID and priority, which makes journalctl -u app -p err useful. Structured JSON is easier to a file, but then you own rotation.

The worst arrangement is both, with different rotation policies, so the timestamps never line up when you need them.