The current Docker default for logging driver is json-file without a limit on the size of the file. This is obviously not great as actively logging containers may fill up all the available disk space if the log driver is not explicitly configured with the limit.
Come up with a way to address this issue. Possible options:

1. Auto-configure the default in Docker daemon config.
2. Store a default for the cluster and patch service specs with it when creating services. Modifying the spec on the fly sounds more like k8s style which is not very obvious. I found Docker Swarm even has proto structure for doing this: https://github.com/moby/swarmkit/blob/447c51903463148a919770d631b0fc67839f68b3/api/types.proto#L851-L859 but I'm not sure if this has actually been implemented and available in CLI.
3. Implement own logs aggregator on each host with rotated storage and configure it as the default using 1. or 2. option. This is a rather the next step for improving logs collection and persistence (including deleted containers). IIUC Flynn had something similar: https://github.com/flynn/flynn/blob/master/docs/content/production.html.md#retrieving-logs