try this approach https://docs.lucee.org/guides/installing-lucee/securing-webinf.html

I'll have to have a look-see what else goes in there, but that could do it. There's no finer-grained config along those lines like

<param-name>lucee-log-directory</param-name>

and

<param-name>lucee-mail-directory</param-name>

? Don't bother going to look if you don't already know. Now I know what sort of thing to look for, I can check it out. Cheers!

this is the remote-client folder right? in

lucee-server.xml

there's

<remote-clients directory="{lucee-config}remote-client/"/>

Yes. Even better would be if Lucee wasn't configured to have it in the web root in the first place, as that stuff was never appropriate to be exposed like that. It's a side-effect of not distinguishing between "web root" and "app root", I guess. But hey-ho, and not related to this question.

you can move the individual log files (although it has to be an absolute path or {home-directory}, we don't use the mail spooler so have never looked at that

that's on the cards for 6, with single context by default for new installs, it's already happening by default

if you are in charge of the docker file you could just mount directories to mail and logs. Lucee is quite well behaved as in it wont delete anything that already exists

Yeah that is a workable avenue as well. As long as they're in an organised location on the host machine, it doesn't really matter where the volumes point to in the container.