Read Logs From a Container That Just Exited

A container that exits right away often looks like it did nothing. It did something, and it wrote down what. The log stays after the container stops, so the first move is always the same: read it.

Find the container and its exit code

Run a container that fails on purpose. The shell command inside prints two lines, then tries to list a folder that does not exist, and exits with code 2.

docker run --name exit-demo alpine:3.24 sh -c "echo step one; ls /nosuchfolder 2>&1; echo step three; exit 2"

step one
ls: /nosuchfolder: No such file or directory
step three

You saw the output because the container was attached to your terminal. A container started with -d or by a script would have shown you nothing. List it, including stopped ones.

docker ps -a --filter name=exit-demo --format "table {{.Names}}\t{{.Status}}"

NAMES       STATUS
exit-demo   Exited (2) Less than a second ago

docker ps without -a would not show it at all, because it is not running. That is the usual reason people think the container vanished. "Exited (2)" is the code the program chose: 0 means success, anything else means failure. Code 137 usually means it was killed, for example by docker stop or by running out of memory.

Read the log

docker logs exit-demo

step one
ls: /nosuchfolder: No such file or directory
step three

That is everything the program wrote to its output and error streams since it started. For a long log, limit it.

docker logs --tail 1 exit-demo

step three

--tail 1 shows the last line. Add --timestamps to put the time in front of each line, --since 10m for the last ten minutes, and -f to follow a running container live until you press Ctrl+C. The last lines are usually where the program says why it stopped.

Ask Docker how it ended

When the log is empty, ask the container itself. docker inspect can print one value.

docker inspect --format "exit code {{.State.ExitCode}}, out of memory: {{.State.OOMKilled}}" exit-demo

exit code 2, out of memory: false

OOMKilled is true when the container was stopped for using too much memory. With the exit code and that flag you can tell a crash from a kill.

The log goes with the container

Remove the container and the log goes with it. That is why --rm and "read the log afterward" do not go together.

docker run --rm --name gone-demo alpine:3.24 echo "bye"
docker logs gone-demo

bye
Error response from daemon: No such container: gone-demo

If you need the output of a run that uses --rm, redirect it to a file as you run it, for example docker run --rm alpine:3.24 echo bye > out.txt. Clean up the container from this page with docker rm exit-demo.

docker rm exit-demo

exit-demo

Related course: Docker for Beginners.