diff --git a/mcp-stack.compose.yml b/mcp-stack.compose.yml
index 02f6605..7624c08 100644
--- a/mcp-stack.compose.yml
+++ b/mcp-stack.compose.yml
@@ -1,5 +1,14 @@
 name: secure-mcp-stack
 
+# Docker's default json-file driver never rotates on its own, so a container that runs for weeks -
+# which every one of these does - writes an unbounded log file. One definition, reused by every
+# service below, so the cap lives in exactly one place.
+x-logging: &default-logging
+  driver: json-file
+  options:
+    max-size: "10m"
+    max-file: "3"
+
 services:
   coding-agent-mcp:
     build:
@@ -25,6 +34,7 @@ services:
     expose: ["3000"]
     networks: [coding-control]
     restart: unless-stopped
+    logging: *default-logging
 
   dev-server-mcp:
     build:
@@ -51,6 +61,7 @@ services:
     networks: [dev-server-control]
     depends_on: [dev-server-worker]
     restart: unless-stopped
+    logging: *default-logging
 
   dev-server-worker:
     build:
@@ -105,6 +116,7 @@ services:
     networks: [dev-server-control, workspace-browser, proxy-control]
     depends_on: [egress-proxy]
     restart: unless-stopped
+    logging: *default-logging
 
   egress-proxy:
     # Installing dependencies means fetching and running other people's code, so the worker has no
@@ -130,6 +142,7 @@ services:
     expose: ["3128"]
     networks: [proxy-control, egress]
     restart: unless-stopped
+    logging: *default-logging
 
   browser-mcp:
     build:
@@ -158,6 +171,7 @@ services:
     expose: ["3000"]
     networks: [workspace-browser]
     restart: unless-stopped
+    logging: *default-logging
 
   mcp-gateway:
     image: caddy:2
@@ -200,6 +214,7 @@ services:
     networks: [gateway, coding-control, dev-server-control, workspace-browser]
     depends_on: [coding-agent-mcp, dev-server-mcp, browser-mcp]
     restart: unless-stopped
+    logging: *default-logging
 
 networks:
   gateway: