How To Use Docker Logs to Debug Containers

The docker logs command is a key diagnostic tool that outputs everything a container writes to standard output (stdout) and standard error (stderr). Whether you're troubleshooting failed startups, inspecting runtime behavior, or reviewing error traces, this command offers a direct view into container activity without needing to attach or exec into it.

While docker logs is ideal for capturing application output, it works best alongside tools like docker inspect and docker exec, which provide metadata and interactive shell access, respectively. This article explains how to use docker logs to inspect, stream, and filter logs so you can pinpoint and resolve issues efficiently.

The Short Answer Version

If you're already familiar with Docker and need a quick reference for checking container logs, use the commands below:

# List all running containers to get the container ID
$ docker container ls

# View logs from a container
$ docker logs <container_id>

# Stream logs in real time
$ docker logs -f <container_id>

# View the last 100 lines of logs
$ docker logs --tail 100 <container_id>

# View logs since a specific time
$ docker logs --since="2025-05-20T10:00:00" <container_id>

# View logs until a specific time
$ docker logs --until="2025-05-20T12:00:00" <container_id>

# View logs with timestamps
$ docker logs --timestamps <container_id>

These commands cover the most common use cases for viewing and filtering logs. Continue reading for in-depth explanations and usage examples.

View Container Logs

Use the docker logs command to view output from a container’s standard output (stdout) and standard error (stderr). This includes application logs, startup messages, and error details, essential for diagnosing issues.

Command Syntax

docker logs <container_id>

• docker logs: Displays the container's complete stdout and stderr output.
• <container_id>: The container’s short or full ID. Run docker container ls to find it.

Use Case

• Displays all logs from the container since it started.
• Does not interrupt or modify the container’s running state.
• Useful for checking if services initialized correctly, troubleshooting startup issues, or inspecting runtime errors.

Command Demonstration

1. List the currently running containers.

   console Copy

   $ docker container ls
   

   Output.

   CONTAINER ID   IMAGE     COMMAND                  CREATED         STATUS         PORTS     NAMES
   ea45fa0f96ac   nginx     "/docker-entrypoint.…"   44 seconds ago  Up 44 seconds  80/tcp    web

2. View the container logs using its ID or name.

   console Copy

   $ docker logs ea45fa0f96ac
   

   Output.

   /docker-entrypoint.sh: /docker-entrypoint.d/ is not empty, will attempt to perform configuration
   /docker-entrypoint.sh: Looking for shell scripts in /docker-entrypoint.d/
   ...
   2025/05/28 20:44:38 [notice] 1#1: start worker process 29

Stream Logs in Real Time

To monitor a running container continuously, use the -f or --follow flag with the docker logs command. This streams log output in real time and is useful when debugging live services or checking active processes.

Command Syntax

docker logs -f <container_id>

• docker logs: Outputs all logs from the container's stdout and stderr.
• -f or --follow: Continuously streams new log entries as they appear.
• <container_id>: The container’s short or full ID.

Use Case

• Streams live logs from both stdout and stderr.
• Keeps the terminal session open until you manually stop it with Ctrl + C.
• Useful for monitoring background jobs, web requests, or live deployment behavior.

Use this flag when observing a container's real-time performance or verifying live system responses.

Command Demonstration

1. List running containers.

   console Copy

   $ docker container ls
   

2. Stream logs from a selected container.

   console Copy

   $ docker logs -f 8f8f72f26159
   

   This streams logs from the container in real time. Replace 8f8f72f26159 with your container ID. To stop, press Ctrl + C.

Filter Logs by Time and Lines

Docker allows you to filter container logs using specific flags. These filters help reduce log clutter, narrow down events within a time window, or extract only the most relevant entries during debugging.

The following flags control how much log data is shown and how it's displayed:

Each of these flags can be combined with docker logs to help you pinpoint issues more efficiently. The following sections explain their syntax and use cases with examples.

Show Recent Log Lines with --tail

Command Syntax

docker logs --tail <number_of_lines> <container_id>

• docker logs: Displays logs from the container’s stdout and stderr.
• --tail <number_of_lines>: Limits output to the last n lines. Accepts values like 10, 100, or 500.
• <container_id>: The container’s short or full ID (use docker container ls to find it).

Use Case

• Shows only the most recent lines from a container’s logs.
• Reduces output clutter when debugging recent activity.
• Useful when you want to avoid scrolling through long logs.

Command Demonstration

1. List running containers to find the container ID.

   console Copy

   $ docker container ls
   

2. View the last 10 lines of logs from the container.

   console Copy

   $ docker logs --tail 10 ea45fa0f96ac
   

   Output.

   /docker-entrypoint.sh: Launching /docker-entrypoint.d/20-envsubst-on-templates.sh
   ...
   2025/05/28 20:44:38 [notice] 1#1: start worker process 29

View Logs From a Specific Time with --since

Command Syntax

docker logs --since="<timestamp>" <container_id>

• docker logs: Displays logs from the container’s stdout and stderr.
• --since="<timestamp>": Filters log entries from the specified time onward. Accepts absolute timestamps like 2025-05-20T10:00:00 or relative formats like 30m, 2h, or 1d.
• <container_id>: The container’s short or full ID.

Use Case

• Filters log output to show only entries created after a specific point in time.
• Helps isolate logs from a known window. Useful during debugging or testing.
• Supports both relative and ISO 8601 timestamp formats.

Use this flag when you're troubleshooting specific time-based events or testing application behavior within a known timeframe.

Command Demonstration

1. List running containers.

   console Copy

   $ docker container ls
   

2. View logs generated after a specific timestamp.

   console Copy

   $ docker logs --since="2025-05-27T10:00:00" ea45fa0f96ac
   

   This command displays logs from container ea45fa0f96ac starting at the given date and time.

3. View logs from the last 30 minutes.

   console Copy

   $ docker logs --since="30m" ea45fa0f96ac
   

   This filters output to just the most recent 30 minutes of activity.

View Logs Until a Specific Time with --until

Command Syntax

docker logs --until="<timestamp>" <container_id>

• docker logs: Displays logs captured from the container's stdout and stderr.
• --until="<timestamp>": Filters logs to show entries created before a specified time. Accepts absolute timestamps like 2025-05-20T12:00:00 or relative values like 30m or 2h.
• <container_id>: The container’s short or full ID.

Use Case

• Limits log output to entries created before a specific point in time.
• Helps identify what happened prior to a known issue or event.
• Works well with --since to define a custom time window.

Use this flag to isolate logs that occurred before an application error, crash, or deployment.

Command Demonstration

1. List running containers.

   console Copy

   $ docker container ls
   

   Identify the container ID you want to inspect.

2. To view logs created before a specific time (e.g., May 28, 2025, at 8:44:39 p.m.).

   console Copy

   $ docker logs --until="2025-05-28T20:44:39" ea45fa0f96ac
   

   Output.

   /docker-entrypoint.sh: /docker-entrypoint.d/ is not empty, will attempt to perform configuration
   /docker-entrypoint.sh: Looking for shell scripts in /docker-entrypoint.d/
   /docker-entrypoint.sh: Launching /docker-entrypoint.d/10-listen-on-ipv6-by-default.sh
   ...

3. To show logs generated more than two hours ago.

   console Copy

   $ docker logs --until="2h" ea45fa0f96ac
   

This flag is especially useful when reviewing logs leading up to a failure window or diagnosing events that happened earlier in the day.

Add Timestamps to Logs with --timestamps

Command Syntax

docker logs --timestamps <container_id>

• docker logs: Displays logs from the container's stdout and stderr.
• --timestamps: Adds a timestamp to the beginning of each log line.
• <container_id>: The container’s short or full ID.

Use Case

• Appends ISO 8601 timestamps to each log entry.
• Helps correlate log events with application behavior and incident timelines.
• Useful for debugging time-sensitive issues.

Use this flag to track when log entries occur, especially during performance bottlenecks or request timing analysis.

Command Demonstration

1. Identify the container to inspect.

   console Copy

   $ docker container ls
   

2. Display logs with timestamps.

   console Copy

   $ docker logs --timestamps ea45fa0f96ac
   

   Output.

   2025-05-28T20:44:38.654359332Z /docker-entrypoint.sh: /docker-entrypoint.d/ is not empty, will attempt to perform configuration
   2025-05-28T20:44:38.664232169Z /docker-entrypoint.sh: Launching /docker-entrypoint.d/10-listen-on-ipv6-by-default.sh
   2025-05-28T20:44:38.690538640Z 2025/05/28 20:44:38 [notice] 1#1: nginx/1.27.5
   2025-05-28T20:44:38.690643927Z 2025/05/28 20:44:38 [notice] 1#1: OS: Linux 6.8.0-60-generic

This flag is especially helpful when working with log aggregators or correlating logs across services.

Handle Errors When Viewing Logs

Running docker logs can sometimes result in errors such as:

Error: No such container: <container_id>

or

Error response from daemon: permission denied

These usually occur due to referencing the wrong container or lacking proper permissions. Use the following solutions to resolve these issues.

"No such container" Error

This error appears if the container ID or name is incorrect, incomplete, or the container has already stopped.

How to Fix It

1. List running containers.

   console Copy

   $ docker container ls
   

2. If the container isn’t running, include stopped containers.

   console Copy

   $ docker container ls -a
   

3. Use the correct container name or full ID.

   console Copy

   $ docker logs <valid_container_id_or_name>
   

Permission Denied Error

This typically happens when the current user does not have access to the Docker daemon.

How to Fix It

1. Use sudo to run the command.

   console Copy

   $ sudo docker logs <container_id>
   

2. To avoid using sudo each time, add your user to the docker group.

   console Copy

   $ sudo usermod -aG docker $USER
   

   Then log out and back in for the group change to take effect.

Conclusion

This article showed you how to use the docker logs command to debug containers effectively. You learned how to view logs from a running container, stream real-time output, and filter log data using flags like --tail, --since, --until, and --timestamps. You also reviewed how to fix common errors related to invalid container IDs or permission issues. These techniques help you diagnose problems faster and maintain stable Docker environments. For more details, see the official Docker logs documentation.