19.2.4.2 Logs Follow Option

The follow option in docker logs keeps the log stream open and prints new output from the container to the terminal as it is written. It is enabled with the -f or --follow flag and transforms docker logs from a one-time historical query into a live, real-time view of the container's stdout and stderr. This is the primary way to monitor a running container's activity without attaching to it.

Basic Usage

docker logs -f my-container

Docker first prints all historical log output from the container, then continues printing each new line as it is written by the container process. The command blocks and the terminal is dedicated to the log stream until it is interrupted.

The long form is equivalent:

docker logs --follow my-container

Stopping the Follow Stream

Press Ctrl+C to stop following. This terminates docker logs -f and returns the shell prompt. The container continues running undisturbed — the -f flag only streams output to the terminal, it does not send any signal to the container.

Combining with --tail to Reduce Historical Noise

By default, -f first prints the full history of container output before beginning to stream. On a long-running container with extensive logs, this can flood the terminal before the live stream begins.

The --tail flag limits how many historical lines are shown before switching to follow mode:

docker logs -f --tail 50 my-container

This shows the last 50 lines of existing output, then follows new output from that point.

docker logs -f --tail 0 my-container

--tail 0 skips all historical output entirely and streams only new lines written after the command is run.

Combining with Timestamps

Adding -t (or --timestamps) prepends each line with an ISO 8601 timestamp:

docker logs -f -t my-container

2024-06-15T10:32:45.123Z Server started
2024-06-15T10:33:01.456Z GET /api/status 200 3ms
2024-06-15T10:33:15.789Z GET /api/status 200 2ms

Timestamps are useful when correlating container events with external events or other service logs.

Use Cases for the Follow Option

Monitoring startup behavior

docker run -d --name app myapp:1.0.0
docker logs -f --tail 0 app

Starting the follow before the container produces meaningful output and watching from the beginning of its lifecycle helps catch startup errors immediately.

Waiting for a service to become ready

docker run -d --name db postgres:15
docker logs -f db 2>&1 | grep -m 1 "database system is ready to accept connections"

This follows the postgres log stream and exits as soon as the readiness message appears. The -m 1 flag tells grep to stop after the first match, which terminates the pipeline.

Debugging a specific request or action

In a development environment, leaving docker logs -f open in a separate terminal panel while interacting with the application shows exactly which log lines are produced by each action.

Post-deployment verification

After deploying a new version of a container, following the logs for the first few minutes confirms that:

• The application starts without errors.
• Database connections are established.
• The application is processing requests.
• No unexpected exceptions are thrown.

Following Logs on Multiple Containers

docker logs -f only accepts a single container at a time. To follow multiple containers simultaneously, either open separate terminals for each or use a tool like docker compose logs -f:

docker compose logs -f

This follows all services in the Compose project, prefixing each line with the service name.

Alternatively, a shell loop can be used:

for container in web-server database cache; do
    docker logs -f "$container" &
done
wait

Each docker logs -f runs in the background. All output appears in the same terminal interleaved. Press Ctrl+C to stop all of them.

Following Logs from the Past

--since with -f starts the stream from a specific point in history, then continues following new output:

docker logs -f --since 10m my-container

This shows logs from the last 10 minutes and then continues streaming live output.

What Happens When the Container Exits

If the container exits while docker logs -f is active, the follow stream ends automatically. Docker prints the remaining buffered output and the command returns. The exit code of docker logs -f is 0 regardless of the container's exit code.

To detect when a container exits while following its logs:

docker logs -f my-container; echo "Container exited"

The echo statement runs after docker logs -f returns.

Performance Considerations

Following logs does not affect container performance directly — Docker reads from the stored log files rather than intercepting the container's output stream in a way that adds latency. However, on a container producing a very high volume of log output, the terminal I/O of rendering thousands of lines per second can consume significant CPU on the host.

For high-throughput log monitoring, consider forwarding container logs to a dedicated logging stack (such as Loki, Elasticsearch, or Splunk) and using that system's query interface rather than docker logs -f.