Viewing container logs in Docker - Step-by-Step Execution

Process Flow - Viewing container logs

Start Docker Container

↓

Container Runs

↓

Logs Generated

↓

Run 'docker logs <container>'

↓

Docker Fetches Logs

↓

Display Logs to User

↓

User Reads Logs or Follows with -f

↓

End or Continue Following

This flow shows how logs are generated by a running container and how the 'docker logs' command fetches and displays them to the user.

Execution Sample

Docker

docker run -d --name myapp nginx

docker logs myapp

docker logs -f myapp

Starts an nginx container in the background, then shows how to view its logs and follow live log output.

Process Table

Step	Command Run	Action	Result/Output
1	docker run -d --name myapp nginx	Start container named 'myapp' in detached mode	Container ID printed, nginx starts running
2	docker logs myapp	Fetch logs from 'myapp' container	Shows nginx startup logs (e.g., 'Starting nginx...')
3	docker logs -f myapp	Follow logs live from 'myapp'	Shows current logs and waits, streaming new logs as they appear
4	Ctrl+C to stop following	Stop live log streaming	Returns to command prompt

💡 User stops following logs or container stops running

Status Tracker

Variable	Start	After Step 1	After Step 2	After Step 3	Final
Container State	Not running	Running (nginx started)	Running (logs fetched)	Running (logs streaming)	Running or stopped depending on user
Logs Available	None	Startup logs generated	Logs displayed once	Logs displayed continuously	Logs remain stored until container removed

Key Moments - 2 Insights

Why do we use '-f' with 'docker logs'?

Using '-f' streams logs live as they are generated, shown in execution_table step 3, so you can watch events in real time instead of seeing only past logs.

What happens if the container is not running when we run 'docker logs'?

You still get the logs generated before the container stopped, because logs are stored until container removal. This is implied in variable_tracker where logs remain available after container stops.

Visual Quiz - 3 Questions

Look at the execution table, what does the command in step 2 do?

A Starts the container named 'myapp'

B Fetches and displays logs from the 'myapp' container

C Stops the container named 'myapp'

D Removes the container named 'myapp'

💡 Hint

Refer to the 'Action' and 'Result/Output' columns in step 2 of the execution table

At which step does the user start seeing live log updates?

A Step 1

B Step 2

C Step 3

D Step 4

💡 Hint

Check the 'Action' column for 'Follow logs live' in the execution table

If the container stops running, what happens to the logs when you run 'docker logs'?

A Logs are lost and cannot be retrieved

B Logs are still available and displayed

C Docker restarts the container automatically

D You get an error saying container not found

💡 Hint

See variable_tracker row 'Logs Available' after container stops

Concept Snapshot

docker logs <container>
- Shows logs from a container
- Use -f to follow logs live
- Logs persist after container stops
- Useful for debugging running or stopped containers

Full Transcript

This lesson shows how to view logs from a Docker container. First, you start a container in detached mode. The container runs and generates logs. You can fetch these logs anytime using 'docker logs <container>'. Adding '-f' streams logs live as they are created. Logs remain available even if the container stops, until it is removed. This helps you monitor and debug containers easily.

Practice

1. What does the command docker logs CONTAINER do?

easy

A. Starts a new container

B. Deletes the specified container

C. Shows the logs of the specified container

D. Lists all running containers

Solution

1. Step 1: Understand the command purpose

   The command docker logs is used to view the output logs of a container.

2. Step 2: Identify the correct action

   Since it shows logs, it helps to see what the container is doing or any errors it has.

3. Final Answer:

   Shows the logs of the specified container -> Option C

4. Quick Check:

   docker logs = show container logs [OK]

Hint: Logs show container output; use docker logs CONTAINER [OK]

Common Mistakes:

• Confusing logs with starting or deleting containers
• Thinking it lists containers instead of showing logs

2. Which of these is the correct syntax to follow live logs of a container named webapp?

easy

A. docker logs webapp -p

B. docker logs -f webapp

C. docker logs --tail webapp

D. docker logs webapp --start

Solution

1. Step 1: Identify the option to follow logs live

   The -f flag means "follow" and shows logs as they appear in real time.

2. Step 2: Check the syntax correctness

   The correct syntax is docker logs -f webapp. Other options are invalid or incorrect.

3. Final Answer:

   docker logs -f webapp -> Option B

4. Quick Check:

   -f means follow logs live [OK]

Hint: Use -f to follow logs live as they update [OK]

Common Mistakes:

• Using --tail without a number to follow logs
• Adding invalid flags like --start or -p
• Placing flags after container name incorrectly

3. What will be the output of the command docker logs --tail 3 mycontainer if the container's last 5 log lines are:

Line1
Line2
Line3
Line4
Line5

medium

A. Line3
Line4
Line5

B. Line1
Line2
Line3

C. Line4
Line5

D. Line1
Line2
Line3
Line4
Line5

Solution

1. Step 1: Understand the --tail option

   The --tail 3 option shows only the last 3 lines of the logs.

2. Step 2: Select the last 3 lines from the given logs

   The last 3 lines are Line3, Line4, and Line5.

3. Final Answer:

   Line3 Line4 Line5 -> Option A

4. Quick Check:

   --tail 3 shows last 3 lines [OK]

Hint: --tail N shows last N lines of logs [OK]

Common Mistakes:

• Choosing first lines instead of last lines
• Confusing --tail with -f
• Expecting all logs instead of limited lines

4. You run docker logs -f myapp but see no output even though the app is running. What is the likely problem?

medium

A. You need to restart Docker daemon

B. The -f flag is not supported

C. Logs are disabled by default

D. The container name is incorrect or not running

Solution

1. Step 1: Check container status and name

   If the container name is wrong or the container is stopped, no logs will appear.

2. Step 2: Understand the -f flag behavior

   The -f flag follows logs live, but if no logs exist or container is not running, output is empty.

3. Final Answer:

   The container name is incorrect or not running -> Option D

4. Quick Check:

   No logs means container name or status issue [OK]

Hint: Check container name and running status first [OK]

Common Mistakes:

• Assuming -f flag is unsupported
• Thinking logs are disabled by default
• Restarting Docker unnecessarily

5. You want to see only the last 10 lines of logs from a container named dbserver and keep watching new logs as they appear. Which command should you use?

hard

A. All of the above

B. docker logs -f --tail 10 dbserver

C. docker logs --tail=10 -f dbserver

D. docker logs --tail 10 -f dbserver

Solution

1. Step 1: Understand combined options usage

   Both -f (follow) and --tail 10 (last 10 lines) can be combined in any order before the container name.

2. Step 2: Check command syntax flexibility

   Docker accepts options in any order before the container name, so all listed commands are valid.

3. Final Answer:

   All of the above -> Option A

4. Quick Check:

   Options order flexible before container name [OK]

Hint: Options order flexible before container name [OK]

Common Mistakes:

• Thinking options must be in fixed order
• Placing options after container name
• Using invalid flags or syntax