diff --git a/monitors/yumi/compose_templates.py b/monitors/yumi/compose_templates.py
index 7f1f020..93731fd 100644
--- a/monitors/yumi/compose_templates.py
+++ b/monitors/yumi/compose_templates.py
@@ -17,6 +17,7 @@ from .ssh_remote import copy_remote_file, run_host_script_checked
 
 # 本地完整 compose 模板统一放到 run 目录，避免把运行期产物写进 Git。
 COMPOSE_TEMPLATE_DIR = ROOT / "run" / "compose_templates"
+DEFAULT_JSON_LOG_OPTIONS = {"max-size": "100m", "max-file": "5"}
 
 def managed_compose_hosts() -> list[dict[str, Any]]:
     # 只维护当前 targets.json 里真正承载业务服务的宿主机。
@@ -290,11 +291,17 @@ def build_service_definition(
         for key, value in (log_config.get("Config") or {}).items()
         if str(key).strip() and value is not None
     }
-    if log_driver and (log_driver != "json-file" or log_options):
+    if log_driver and log_driver != "json-file":
         logging_definition: dict[str, Any] = {"driver": log_driver}
         if log_options:
             logging_definition["options"] = log_options
         service_definition["logging"] = logging_definition
+    else:
+        # Keep json-file logs bounded even when Docker daemon defaults are not visible in inspect.
+        service_definition["logging"] = {
+            "driver": "json-file",
+            "options": {**log_options, **DEFAULT_JSON_LOG_OPTIONS},
+        }
 
     stop_signal = str(config.get("StopSignal") or "").strip()
     if stop_signal: