The Triage Sequence

When the Pager Goes Off

Container debugging is fast if you're systematic. Burn this sequence in:

$ docker ps -a                # 1. state: Up? Exited (1)? Restarting? Created?
$ docker logs --tail 50 app   # 2. what did the process say before dying?
$ docker inspect app          # 3. config: env, mounts, ports, policy, health
$ docker stats --no-stream    # 4. live CPU/memory - is something starving?
$ docker events --since 10m   # 5. daemon's view: kills, OOMs, restarts

Decoding docker ps -a STATUS:

Status	Meaning	First move
`Exited (0)`	finished normally	was it supposed to keep running? check CMD
`Exited (1)`	app error	`docker logs`
`Exited (137)`	SIGKILL - usually OOM-killed	`docker inspect` → `.State.OOMKilled`, raise --memory or fix leak
`Exited (126/127)`	command not found / not executable	check CMD/ENTRYPOINT paths
`Restarting (1) …`	crash loop (dies + restart policy)	`docker logs` - often missing env/config
`Created`	never started	port conflict or bad device/mount - `docker start` shows the error

Tip: Exit code 137 = 128 + 9 (SIGKILL). 139 = segfault (SIGSEGV). Memorizing just those two makes you look psychic in incident channels.