6.2.1.3 Detached Log Viewing

Detached log viewing is the practice of retrieving a detached container's output after the fact, using docker logs, since detached mode does not stream that output directly to the terminal that launched it.

Viewing Accumulated Logs

The most basic use of docker logs retrieves everything the container has output since it started.

docker run -d --name myapp myapp:1.0
docker logs myapp

Following Logs in Real Time

The -f flag streams new log output continuously, similar to what attached mode would have shown directly, useful for observing a detached container's ongoing behavior.

docker logs -f myapp

This continues displaying new output as it's produced, until manually interrupted.

Viewing Only Recent Log Output

For a container that has been running for a long time and accumulated substantial log output, limiting the view to only the most recent entries avoids being overwhelmed by historical output.

docker logs --tail 100 myapp

Viewing Logs Within a Specific Time Range

Logs can also be filtered to a specific time window, useful for investigating behavior around a specific known incident.

docker logs --since 2026-06-24T10:00:00 --until 2026-06-24T10:15:00 myapp

Why Log Retention Depends on the Configured Logging Driver

How much log history is actually retained, and for how long, depends on Docker's configured logging driver — the default driver retains logs as long as the container exists, but this is configurable and worth understanding for any container expected to run for an extended period.

docker inspect myapp --format '{{.HostConfig.LogConfig}}'

Why Detached Log Viewing Matters

Because detached containers don't stream their output directly, docker logs is the essential tool for observing what a detached container has actually been doing, both for routine monitoring and for diagnosing unexpected behavior after the fact.