Debugging

docker logs -f [--tail <n>] <container>

docker logs -f --tail 100 web-api
docker logs -f --since 5m web-api

Server started on port 3000
GET /api/health 200 2ms
POST /api/users 201 45ms

Note Combine --tail to avoid the initial flood and --since to only see recent entries. Pressing Ctrl+C stops following but does not affect the container.

docker exec -it <container> <shell>

docker exec -it web-api sh
docker exec -it db-postgres bash
docker exec -it web-api sh -c 'ls -la /app && cat /app/.env'

/app #

Note Alpine-based images have sh but not bash. If the container has no shell at all (distroless or scratch), you can use docker debug (Docker Desktop) or copy a static busybox binary in via docker cp.

docker inspect <container>

docker inspect web-api
docker inspect web-api --format '{{.NetworkSettings.IPAddress}}'
docker inspect web-api --format '{{json .State}}'

172.17.0.3

Note Returns comprehensive JSON with networking, mounts, environment, state, and configuration. The --format flag with Go templates extracts exactly what you need without piping through jq.

docker top <container>

docker top web-api

UID     PID     PPID    CMD
root    12345   12300   node server.js
root    12350   12345   /usr/bin/node worker.js

Note Shows the process tree from the host's perspective. Useful for confirming which processes are actually running and spotting zombie or unexpected processes.

docker events [options]

docker events
docker events --filter container=web-api --filter event=die
docker events --since 10m --until 5m

2025-11-15T10:30:00.000 container start abc123 (name=web-api)
2025-11-15T10:30:05.000 container die abc123 (exitCode=137, name=web-api)

Note Streams lifecycle events (create, start, die, destroy, OOM) in real time. Filter by container, image, or event type. Exit code 137 means OOM killed (128 + signal 9).

docker system df [-v]

docker system df
docker system df -v

TYPE            TOTAL     ACTIVE    SIZE      RECLAIMABLE
Images          15        5         4.2GB     2.8GB (66%)
Containers      8         3         125MB     95MB (76%)
Volumes         6         3         1.1GB     400MB (36%)
Build Cache     -         -         850MB     850MB

Note Quick overview of what is consuming disk. Add -v for a per-item breakdown. The RECLAIMABLE column shows how much you can free with prune commands.

docker system prune [options]

docker system prune
docker system prune -a --volumes

Total reclaimed space: 5.7GB

Note Without flags: removes stopped containers, unused networks, dangling images, and build cache. With -a: also removes all unused images (not just dangling). With --volumes: also removes unused volumes. This is the nuclear option — it can delete data you care about.

docker cp <container>:<path> <host_path>
docker cp <host_path> <container>:<path>

docker cp web-api:/app/logs/error.log ./error.log
docker cp ./hotfix.js web-api:/app/hotfix.js

Note Works on both running and stopped containers. Useful for extracting crash logs or injecting a config file for debugging. Changes via cp do not persist across container recreation — use volumes for anything permanent.

docker diff <container>

docker diff web-api

C /app
A /app/logs/error.log
A /tmp/cache-abc123
D /app/config.bak

Note Shows which files were Added (A), Changed (C), or Deleted (D) compared to the image. Handy for understanding what the running process has modified on disk.