19.2.4.3 Logs Tail Option

The tail option in docker logs limits the output to the last N lines of a container's log history. Without it, docker logs prints the entire accumulated output since the container started, which for long-running containers can be thousands or millions of lines. The --tail flag makes log inspection practical by returning only a recent slice of the output.

Basic Usage

docker logs --tail 100 my-container

This prints only the last 100 lines written by the container, regardless of how much total output exists. If the container has produced fewer than 100 lines, all of them are shown.

The all Value

The default behavior of docker logs (without --tail) is equivalent to --tail all:

docker logs --tail all my-container

This returns the complete log history. On a container that has been running for days with high logging volume, this can be very large.

Using Zero to Skip Historical Output

docker logs --tail 0 my-container

This outputs nothing from the historical log. When combined with --follow, it means "stream only new output from now, ignoring everything that was written before":

docker logs --tail 0 -f my-container

This is useful for monitoring a container that has already been running for some time but where you only care about what happens going forward.

Practical Line Count Choices

There is no universal correct value for --tail. The right number depends on the container's log density and the depth of context needed:

Combining with --follow

docker logs --tail 50 -f my-container

This prints the last 50 historical lines and then begins streaming new output in real time. The tail controls how far back the catch-up goes before the live stream begins. Without --tail, the catch-up phase includes all historical output, which can be lengthy.

Combining with Timestamps

docker logs --tail 100 -t my-container

Adds timestamps to each of the 100 lines, making it easy to see when they were produced.

Combining with Time-Based Filters

--tail and --since can be used together, though they address different dimensions of the output:

• --tail limits by number of lines (counting from the end).
• --since limits by time (discarding lines older than the threshold).

They are ANDed: the output is the intersection — lines that satisfy both constraints.

docker logs --tail 50 --since 5m my-container

This returns up to 50 of the most recent log lines, but only those written in the last 5 minutes.

--tail in Scripts and Automation

In automated workflows that need to inspect recent container output (post-deployment checks, health monitors), --tail prevents overwhelming output:

# Check if an error appeared in the last 50 lines
if docker logs --tail 50 my-container 2>&1 | grep -q "ERROR"; then
    echo "Error detected in container logs"
fi

Without --tail, this grep would scan the entire log history on every check, which grows unbounded over time.

Relationship to Log File Storage

--tail does not affect what is stored on disk. All container output is retained in the log files according to the logging driver's configuration. --tail only controls how much of that stored data is retrieved and printed to the terminal on a specific invocation.

If log rotation is configured (e.g., max-file=5, max-size=10m), lines that have been rotated out of the oldest log file may no longer be retrievable. In that case, --tail all returns only what remains within the current rotation window, not the complete lifetime output.

--tail and the json-file Driver

When the default json-file logging driver is in use, --tail N causes Docker to read from the end of the JSON log file and return the last N entries. This is efficient because Docker seeks backward from the end of the file rather than reading all entries from the beginning.

For very large log files, --tail is significantly faster than --tail all because it avoids reading the entire file.