Reading the access log is in the access log

The SOC analyst asks for the access log of the payroll container. You send a URL.

Every container's proxy records the traffic that reached its services: method, path, status, client IP, user agent, duration, bytes. GET /_logs queries it by kind, method, and time range. GET /_logs/stream tails it live over SSE. Sensitive headers and bodies are redacted at capture, and reads through the container's logs service apply that redaction regardless of configuration.

The part the analyst notices: every read of those logs, and every administrative action against them, is written to its own trail alongside them, noting what was done, from where, and which container it touched. The service is read-only. Nobody holding the URL can clear it.

The auditor's question is always who looked, and when. Here the answer is a query.