How do I tail the last N lines of a Docker container log?

docker logs --tail 100 prints the last 100 lines; add -f to keep following new output. Without --tail, docker logs replays the entire history first, which on a long-lived container can be enormous.

Where does Docker store container logs on disk?

With the default json-file driver, at /var/lib/docker/containers/ / -json.log on the host. Prefer docker logs over reading these files directly: the path, format, and driver can change, and the CLI handles both streams and rotation.

Why is my docker logs output empty?

Almost always because the app logs to a file inside the container rather than stdout/stderr: docker logs only sees the standard streams of the main process. Reconfigure the app to log to stdout, or symlink its log files to /dev/stdout and /dev/stderr.

Do Docker logs survive a container restart?

Yes: the log file belongs to the container, and restart or stop/start keeps appending to it. Logs are lost when the container is removed (docker rm, docker compose down, --rm), so capture what you need before recreating.

How do I limit how much disk space Docker logs use?

Set max-size and max-file log-opts: globally in /etc/docker/daemon.json or per container with --log-opt. Note the daemon.json setting only applies to containers created after the change; existing containers keep their original log config until recreated.

How-to

docker logs: Tail, Follow, Filter, and Save Container Logs

Updated July 27, 2026

In short

Read container logs with docker logs -f --tail 100 <container-name>: the last 100 lines, then follow live. docker logs shows everything the container's main process wrote to stdout and stderr; apps that log to files inside the container produce nothing here. Filter by time with --since/--until, add timestamps with -t, and save to a file with shell redirection (append 2>&1 to capture stderr). For Compose stacks, docker compose logs -f <service> is the same idea per service.

start here

docker logs -f --tail 100 <container-name>

Step 1

Step 1: the flags that matter

-f follows live output like tail -f; --tail N (or -n N) limits how much history is printed first: without it, docker logs dumps the entire log from container creation. --since and --until accept durations (30m, 24h) or RFC 3339 timestamps, and -t prefixes each line with its timestamp, which is essential when correlating with other systems.

docker logs -f --tail 100 api          # last 100 lines, then follow
docker logs --since 30m api            # last 30 minutes
docker logs -t --since 2026-07-27T09:00:00 --until 2026-07-27T10:00:00 api
docker logs api 2>&1 | grep -i error   # search both streams

Step 2

Step 2: write logs to a file

docker logs writes the container's stdout to your stdout and its stderr to your stderr: a plain > redirect silently drops the stderr stream, where most apps put their errors. Merge with 2>&1 before redirecting or piping.

# full capture (both streams):
docker logs api > api.log 2>&1

# only errors (stderr stream):
docker logs api 2> api-errors.log

# continuous capture in the background:
nohup docker logs -f api > api.log 2>&1 &

Step 3

Step 3: configure the driver and rotation

The default json-file driver stores logs unrotated by default: a chatty container can quietly fill the disk. Set rotation daemon-wide in /etc/docker/daemon.json (new containers only) or per container with --log-opt. The local driver is a more compact, rotated-by-default alternative. Since Docker 20.10, dual logging keeps docker logs working even when a remote driver (fluentd, syslog, awslogs) ships logs elsewhere.

// /etc/docker/daemon.json
{
  "log-driver": "json-file",
  "log-opts": { "max-size": "10m", "max-file": "3" }
}

# per container:
docker run -d --log-opt max-size=10m --log-opt max-file=3 myapp:1.5

Step 4

Step 4: Compose logs

docker compose logs aggregates all services with color-coded prefixes, or targets one service by name. The flags mirror docker logs; --no-log-prefix helps when piping into other tools.

docker compose logs -f --tail 50            # all services
docker compose logs -f --tail 100 api       # one service
docker compose logs --since 15m api worker  # subset, time-bounded

Why docker logs shows nothing

Three usual reasons. The app writes to a log file inside the container instead of stdout/stderr: reconfigure it, or symlink the file to /dev/stdout as the official nginx image does. The container uses a logging driver without dual-logging support for reading back. Or you are looking at the wrong process: docker logs only captures PID 1, so services started by a supervisor inside the container need their output routed through it.

# the nginx-image trick — route file logs to the container streams:
RUN ln -sf /dev/stdout /var/log/nginx/access.log \
 && ln -sf /dev/stderr /var/log/nginx/error.log

Beyond the one-off fix

docker logs answers "what did this process say", but for AI agents the harder question is "what did this agent do". Console output from an agent is narrative; the actions are what matter. Nexus captures every agent action through runtime hooks (each command run, file touched, and API called) producing a structured, queryable stream that is to agent behavior what docker logs is to a container: the ground-truth record you pull up when something looks wrong.

Explore Swfte Nexus

Common questions

How do I tail the last N lines of a Docker container log?: docker logs --tail 100 <container> prints the last 100 lines; add -f to keep following new output. Without --tail, docker logs replays the entire history first, which on a long-lived container can be enormous.
Where does Docker store container logs on disk?: With the default json-file driver, at /var/lib/docker/containers/<container-id>/<container-id>-json.log on the host. Prefer docker logs over reading these files directly: the path, format, and driver can change, and the CLI handles both streams and rotation.
Why is my docker logs output empty?: Almost always because the app logs to a file inside the container rather than stdout/stderr: docker logs only sees the standard streams of the main process. Reconfigure the app to log to stdout, or symlink its log files to /dev/stdout and /dev/stderr.
Do Docker logs survive a container restart?: Yes: the log file belongs to the container, and restart or stop/start keeps appending to it. Logs are lost when the container is removed (docker rm, docker compose down, --rm), so capture what you need before recreating.
How do I limit how much disk space Docker logs use?: Set max-size and max-file log-opts: globally in /etc/docker/daemon.json or per container with --log-opt. Note the daemon.json setting only applies to containers created after the change; existing containers keep their original log config until recreated.