Hey, just wanted to share what I did to prevent the need for the host bind mount.

The idea is that I use a different location for the /dev/log socket, so that I can do --volumes-from without conflict. On another container, I just symlink /dev/log to that location. I also send the logs that I want to stderr so that I can do docker logs to get them.

syslog Dockerfile:

FROM debian:jessie

RUN apt-get update && \
    apt-get install rsyslog --no-install-recommends -y && \
    apt-get clean && \
    rm -rf /var/lib/apt/lists/*

COPY rsyslog.conf /etc/
VOLUME /var/run/rsyslog/dev

CMD ["rsyslogd", "-n"]

/etc/rsyslog.conf:

# load imuxsock module with alternative socket location
module(load="imuxsock")
input(type="imuxsock" Socket="/var/run/rsyslog/dev/log" CreatePath="on")

...

#
# Send your logs to stderr so that `docker logs` works
#
local1.*  {
    /proc/self/fd/2
    stop
}

Now, for example, in a PHP container you do --volumes-from syslog and run ln -sf /var/run/rsyslog/dev/log /dev/log (I do it in an entrypoint, but you get the idea of what needs to happen).

Example:

php:
  build: docker/php
  volumes_from:
    - syslog

syslog:
  image: helder/syslog

Now when my PHP container sends something to LOCAL1 using syslog, I get those with docker-compose logs syslog.