I went through some strange ritual to somehow start system logging. I needed to track authorization through the PAM service.
My commands:
run --privileged ... image
Commands in container
apk add syslog-ng busybox-openrc rc-update add syslog boot rc-status touch /run/openrc/softlevel rc-service syslog start rc-service syslog status Then I tracked the logs in the file /var/log/messages
(UPDATE)
Can run in unprivileged mode
Dockerfile
RUN <<EOF apk add syslog-ng busybox-openrc rc-update add syslog boot EOF entrypoint.sh
rc-status touch /run/openrc/softlevel rc-service syslog start rc-service syslog status docker exec -it container tail -f /var/log/messages