How do you view container logs in Docker?
In Docker, container logs are viewed using the docker logs command. It streams or displays the stdout and stderr output of a container. Docker provides rich options to filter logs by time, follow live output, show timestamps, and limit the number of lines — making it the primary tool for debugging and monitoring containerized applications.
- 1
Docker captures everything written to stdout and stderr as container logs
- 2
Logs from files inside the container are NOT captured by docker logs
- 3
The default logging driver is json-file — stores logs as JSON on the host
- 4
docker logs works for both running and stopped containers
- 5
Logs persist until the container is removed or logs are rotated
- 6
Container name or container ID can be used interchangeably
- 1
docker logs <container> — show all logs
- 2
docker logs -f <container> — follow/stream live logs
- 3
docker logs -t <container> — show logs with timestamps
- 4
docker logs --tail N <container> — show last N lines only
- 5
docker logs --since Xm <container> — logs from last X minutes/hours
- 6
docker logs --until <time> — logs before a specific time
- 7
docker logs -tf --tail 100 — most useful debug combo
- 1
docker logs only captures stdout and stderr — app must log to these streams
- 2
docker logs -f is the go-to command for real-time debugging of live containers
- 3
Pipe docker logs to grep for powerful filtering — docker has no built-in search
- 4
Use --since and --until to narrow logs to a specific incident time window
- 5
Configure log rotation with max-size and max-file to prevent disk exhaustion
- 6
docker logs does NOT work with non json-file drivers like fluentd or awslogs
- 7
In production, ship logs to a centralized system — ELK Stack, CloudWatch, Datadog, Loki
Scenario Questions
0-2 years experience
- 1You have a container running a Node.js app locally. How would you retrieve its stdout and stderr output to debug a crash?
- 2If you run `docker logs my_container` and see no output, what are the possible reasons and how would you verify them?
2-5 years experience
- 1Your team deployed a microservice using Docker Compose, and the logs are interleaved with other services. How would you isolate the logs for just the failing service and what options would you consider for log retention?
- 2During a CI pipeline, a container exits with an error and the logs are truncated. What steps would you take to get the full logs and ensure future runs capture them completely?
5-8 years experience
- 1We need to aggregate logs from hundreds of containers across multiple hosts into a searchable system. Explain how Docker's logging drivers influence your design and what trade‑offs you’d evaluate when choosing between the json‑file driver and a centralized syslog/ELK solution.
- 2A production service experiences intermittent latency spikes, and you suspect log volume is impacting disk I/O. How would you redesign the logging configuration at the container level to mitigate this while still retaining enough detail for debugging?
8+ years experience
- 1Our organization is moving from on‑prem Docker hosts to a hybrid cloud environment. Describe the strategy you’d use to standardize log collection, retention, and access across teams, considering compliance, cost, and operational overhead.
- 2You inherit a legacy monolith that runs many Docker containers, each with its own custom log format. How would you design a migration plan to unify logging, minimize disruption, and provide a consistent API for downstream analytics?
Follow-up Questions
- What would you do if the container was started with a custom logging driver that doesn't support `docker logs`?
- How do you handle log rotation for containers using the json‑file driver in production?
- Can you describe a situation where tailing logs in real time could be problematic, and how you'd mitigate it?