Dockerd and rsyslogd flooding journalctl and pushing CPU to 100% until crash

[Luna the Deer]

This started happening fairly recently. If my Docker containers are left running for a period of time, this message will start appearing over and over in journalctl:

dockerd[1491]: time="2025-12-27T20:55:44.808894213-05:00" level=error msg="Error writing log message" driver=json-file error="error writing log entry: write /var/lib/docker/containers/97e823567c56600b69888e6abf63189c6f586afbf6bcf06fca820eaf4ef46f7d/97e823567c56600b69888e6abf63189c6f586afbf6bcf06fca820eaf4ef46f7d-json.log: no space left on device" message=

After a while, these two messages will start repeating (these were taken from a different instance of this happening, so the PID is different):

rsyslogd[599]: action 'action-0-builtin:omfile' (module 'builtin:omfile') message lost, could not be processed. Check for additional error messages before this one. [v8.2504.0 try https://www.rsyslog.com/e/2027 ]
rsyslogd[599]: file '/var/log/syslog'[7] write error - see https://www.rsyslog.com/solving-rsyslog-write-errors/ for help OS error: No space left on device [v8.2504.0 try https://www.rsyslog.com/e/2027 ]

Looking at btop when this is happening shows that the rsyslog and dockerd processes are using up most of the CPU, along with fail2ban for some reason. The full command for dockerd is:

/usr/bin/dockerd -H fd:// --containerd=/run/containerd/containerd.sock

Here are all my docker packages:

docker-buildx-plugin/trixie,now 0.30.1-1~debian.13~trixie arm64 [installed]
docker-ce-cli/trixie,now 5:29.1.3-1~debian.13~trixie arm64 [installed]
docker-ce/trixie,now 5:29.1.3-1~debian.13~trixie arm64 [installed]
docker-compose-plugin/trixie,now 5.0.0-1~debian.13~trixie arm64 [installed]