How do you view and manage container logs?

Basic usage

docker logs my-container                # show all accumulated logs
docker logs -f my-container               # follow/stream logs live, as they're written
docker logs --tail 100 my-container         # only the most recent 100 lines
docker logs --since 10m my-container          # only logs from the last 10 minutes
docker logs -t my-container                    # include timestamps for each line

These flags combine freely — docker logs -f --tail 50 --since 5m my-container follows live output, starting from the last 50 lines within the last 5 minutes.

Where these logs actually come from

Docker only captures what a container's main process writes to stdout and stderr. This is why best practice, borrowed from the twelve-factor app methodology, is for containerized applications to log to stdout/stderr rather than write to internal log files — only stdout/stderr gets captured automatically by Docker's logging mechanism.

docker inspect my-container --format='{{.HostConfig.LogConfig.Type}}'
# json-file   (the default logging driver)

By default, Docker uses the json-file logging driver, which writes each log line as a JSON object to a file on the host's disk, typically under /var/lib/docker/containers/<container-id>/. This is what docker logs actually reads from.

The default's real limitations at scale

docker inspect my-container --format='{{.LogPath}}'

The default json-file driver has no automatic log rotation out of the box. A long-running, chatty container can fill up the host's disk with an ever-growing log file if you don't configure this explicitly. It's also tied to that one host and container — there's no built-in way to search or aggregate logs across many containers or hosts. This becomes a real operational gap once you're running more than a handful of containers.

Configuring log rotation for the default driver

docker run --log-opt max-size=10m --log-opt max-file=3 myapp

This caps each log file at 10MB, keeping at most 3 rotated files — a reasonable minimum safeguard for any container running the default driver where unbounded log growth would actually be a problem.

Alternative logging drivers for production

docker run --log-driver=syslog --log-opt syslog-address=udp://loghost:514 myapp
docker run --log-driver=json-file --log-driver=awslogs --log-opt awslogs-group=myapp myapp

Docker supports several alternative logging drivers — syslog, journald, fluentd, awslogs, gelf, and others — that forward log output directly to an external logging system instead of, or alongside, writing local JSON files. This is the standard approach for real production log management, especially once you're running many containers across many hosts, where centralized, searchable, durable logging becomes essential. It mirrors the DaemonSet-based log-shipping pattern used in Kubernetes.

A key caveat about switching drivers

Once you configure a non-default logging driver, like syslog or awslogs, docker logs generally stops working for that container, since it specifically reads the local json-file format. Logs are only accessible through whatever external system the chosen driver forwards them to. Know this tradeoff before switching drivers in an environment where people are used to reaching for docker logs directly.