docker logsRead a container's stdout and stderr
docker logs shows what a container's main process wrote to stdout and stderr: tail it, follow it, filter by time. It's the first thing to check when a container crashes, and with the default driver those logs live in a JSON file on the host that grows until you cap it.
docker logs [OPTIONS] CONTAINERUsers report 404s from the web container. You want its most recent log lines with exact times.
docker logsPrint the captured stdout and stderr of a container, running or stopped.
A container's PID 1 writes to stdout and stderr, which are pipes held by the containerd shim, not a terminal. dockerd reads them and hands each line to the logging driver. The default json-file driver appends {"log":"...","stream":"stdout","time":"..."} records to /var/lib/docker/containers/<id>/<id>-json.log; docker logs reads that file back, and -f watches it for new lines. Only PID 1's output streams are captured: an app writing to /var/log/app.log inside the container shows nothing, which is why official images symlink their log files to /dev/stdout. Without max-size, the JSON file is never rotated. With remote drivers (awslogs, fluentd, syslog) dockerd also keeps a small local cache so docker logs still works.
-f, --followKeep streaming new output--tail NOnly the last N lines (default all)--since TIMEFrom a relative (10m, 2h) or absolute time--until TIMEUp to a time, to cut out a window around an incident-t, --timestampsShow docker's receive timestamp on every line--detailsShow extra attributes added by --log-opt labels/env--log-opt max-size=10m (run)Cap and rotate the JSON log file for this container--log-driver DRIVER (run)json-file, local, journald, awslogs, fluentd, syslog, nonedocker logs -f api | grep ERROR and trusting the empty resultContainer stderr goes to your terminal's stderr, which doesn't go through the pipe.
docker logs -f api 2>&1 | grep ERRORRunning with the default json-file driver and no max-sizeLogs grow forever in /var/lib/docker/containers and eventually fill the disk.
Set log-opts max-size and max-file in /etc/docker/daemon.json, or use the local driverrm /var/lib/docker/containers/<id>/<id>-json.log to free spacedockerd still holds the file open, so the space isn't released, and docker logs breaks for that container.
truncate -s 0 the file, then fix rotationHaving the app write to /app/logs/app.log inside the containerdocker logs shows nothing, the writable layer grows, and logs vanish with the container.
Log to stdout/stderr (or symlink the file to /dev/stdout)Try these on a Linux machine of your own. Each task has a hint and a solution.
Follow the web container's log live, starting from its last 20 lines. In a second terminal tab, curl localhost:8080/nope and watch the request (and the 404 error line) appear.
Write the docker command to show only the error lines from the last 15 minutes of container api, including its stderr.
Write the /etc/docker/daemon.json content that limits every container's logs to 5 files of 20 MB.
In the sandbox, find the biggest files under /var/log/app the way you would find a runaway container log.
docker logsRead a container's stdout and stderr
docker logs shows what a container's main process wrote to stdout and stderr: tail it, follow it, filter by time. It's the first thing to check when a container crashes, and with the default driver those logs live in a JSON file on the host that grows until you cap it.
docker logs [OPTIONS] CONTAINERUsers report 404s from the web container. You want its most recent log lines with exact times.
docker logsPrint the captured stdout and stderr of a container, running or stopped.
A container's PID 1 writes to stdout and stderr, which are pipes held by the containerd shim, not a terminal. dockerd reads them and hands each line to the logging driver. The default json-file driver appends {"log":"...","stream":"stdout","time":"..."} records to /var/lib/docker/containers/<id>/<id>-json.log; docker logs reads that file back, and -f watches it for new lines. Only PID 1's output streams are captured: an app writing to /var/log/app.log inside the container shows nothing, which is why official images symlink their log files to /dev/stdout. Without max-size, the JSON file is never rotated. With remote drivers (awslogs, fluentd, syslog) dockerd also keeps a small local cache so docker logs still works.
-f, --followKeep streaming new output--tail NOnly the last N lines (default all)--since TIMEFrom a relative (10m, 2h) or absolute time--until TIMEUp to a time, to cut out a window around an incident-t, --timestampsShow docker's receive timestamp on every line--detailsShow extra attributes added by --log-opt labels/env--log-opt max-size=10m (run)Cap and rotate the JSON log file for this container--log-driver DRIVER (run)json-file, local, journald, awslogs, fluentd, syslog, nonedocker logs -f api | grep ERROR and trusting the empty resultContainer stderr goes to your terminal's stderr, which doesn't go through the pipe.
docker logs -f api 2>&1 | grep ERRORRunning with the default json-file driver and no max-sizeLogs grow forever in /var/lib/docker/containers and eventually fill the disk.
Set log-opts max-size and max-file in /etc/docker/daemon.json, or use the local driverrm /var/lib/docker/containers/<id>/<id>-json.log to free spacedockerd still holds the file open, so the space isn't released, and docker logs breaks for that container.
truncate -s 0 the file, then fix rotationHaving the app write to /app/logs/app.log inside the containerdocker logs shows nothing, the writable layer grows, and logs vanish with the container.
Log to stdout/stderr (or symlink the file to /dev/stdout)Try these on a Linux machine of your own. Each task has a hint and a solution.
Follow the web container's log live, starting from its last 20 lines. In a second terminal tab, curl localhost:8080/nope and watch the request (and the 404 error line) appear.
Write the docker command to show only the error lines from the last 15 minutes of container api, including its stderr.
Write the /etc/docker/daemon.json content that limits every container's logs to 5 files of 20 MB.
In the sandbox, find the biggest files under /var/log/app the way you would find a runaway container log.