In Docker, container logs are viewed using the docker logs command. It streams or displays the stdout and stderr output of a container. Docker provides rich options to filter logs by time, follow live output, show timestamps, and limit the number of lines — making it the primary tool for debugging and monitoring containerized applications.
Docker captures everything written to stdout and stderr as container logs
Logs from files inside the container are NOT captured by docker logs
The default logging driver is json-file — stores logs as JSON on the host
docker logs works for both running and stopped containers
Logs persist until the container is removed or logs are rotated
Container name or container ID can be used interchangeably
docker logs <container> — show all logs
docker logs -f <container> — follow/stream live logs
docker logs -t <container> — show logs with timestamps
docker logs --tail N <container> — show last N lines only
docker logs --since Xm <container> — logs from last X minutes/hours
docker logs --until <time> — logs before a specific time
docker logs -tf --tail 100 — most useful debug combo
docker logs only captures stdout and stderr — app must log to these streams
docker logs -f is the go-to command for real-time debugging of live containers
Pipe docker logs to grep for powerful filtering — docker has no built-in search
Use --since and --until to narrow logs to a specific incident time window
Configure log rotation with max-size and max-file to prevent disk exhaustion
docker logs does NOT work with non json-file drivers like fluentd or awslogs
In production, ship logs to a centralized system — ELK Stack, CloudWatch, Datadog, Loki