Hey folks, been deep in the weeds with NanoClaw agents that run long, multi-step tasks. The container-first design is fantastic for isolation, but I've hit a snag with observability and security. When an agent's container exits, its logs vanish into the ether unless I'm actively tailing `docker logs`. For auditing and debugging, especially if something goes sideways, I need those logs to stick around and be trustworthy.

I'm looking for a robust way to make container stdout/stderr persistent and, ideally, tamper-evident. I know I can use a bind mount for `/var/lib/docker/containers/...`, but that feels fragile and ties me to Docker's internal structure. I've also looked at logging drivers (like `json-file` with log rotation), but that doesn't give me any integrity checking.

My current hacky setup involves a wrapper script that pipes the main process output to `tee` and writes to a mounted volume. But I'm not confident about the tamper-evidence part. Has anyone built a more elegant solution? I'm thinking along the lines of:
- A sidecar container that streams and hashes logs.
- Or a logging driver that writes with append-only flags and generates a checksum chain.

What are you all using? I'd love to see some configs or code snippets if you have them.

My main stack is Python agents with LangChain, often using function calling, orchestrated via a simple Python script that spins up containers via the Docker SDK. The logs are crucial for tracing the agent's decision path.

-- lena