Docker stores everything a container's main process writes to stdout and stderr. docker logs prints it back, for running and stopped containers.

PID 1 ──stdout──┐
                ├──► Docker log store ──► docker logs NAME
PID 1 ──stderr──┘    (kept until the container is removed)

Official images send their logs to stdout/stderr for this reason. nginx, for example, links its access log to stdout and its error log to stderr.

Read the logs

A worker that prints a line every 2 seconds:

docker run -d --name ticker alpine:3.20 sh -c 'while true; do echo "heartbeat queue=reports pending=0"; sleep 2; done'
docker logs ticker

heartbeat queue=reports pending=0
heartbeat queue=reports pending=0
heartbeat queue=reports pending=0
heartbeat queue=reports pending=0

Narrow the output

docker logs -t --tail 2 ticker

2026-10-11T20:48:13.300000000Z heartbeat queue=reports pending=0
2026-10-11T20:48:15.300000000Z heartbeat queue=reports pending=0

Combine -f with --tail to skip old output and watch new lines:

docker logs -f --tail 1 ticker

Press Ctrl+C to return to the prompt. The container keeps running.

Stopped containers keep their logs

A failed one-off is the main reason to read logs:

docker run --name migrate alpine:3.20 sh -c 'echo "applying 001_create_users"; echo "ERROR: table users already exists" >&2; exit 1'
docker logs migrate

applying 001_create_users
ERROR: table users already exists

The logs are deleted with the container (docker rm), not when it stops.

stdout, stderr and pipes

docker logs keeps the two streams apart: the container's stdout goes to your stdout, its stderr to your stderr. On screen they look the same. In a pipe or a redirect they are not: