Looking Inside: logs & exec

Your Two Debugging Superpowers

A running container is mostly a black box from the outside - you can't just double-click it and look inside like a folder on your desktop. Docker gives you two commands that open that box up, and you will use both of them constantly.

docker logs shows everything the main process wrote to stdout/stderr (the two standard output streams every program can print to - stdout for normal output, stderr for errors) - in containers, apps log to the console, not to files:

$ docker logs web              # everything so far
$ docker logs -f web           # follow live (like tail -f)
$ docker logs --tail 50 web    # last 50 lines

docker exec runs an extra command inside a running container:

$ docker exec web ls /usr/share/nginx/html    # one-off command
$ docker exec -it web sh                      # interactive shell

Scenario: Production serves the wrong page. Instead of redeploying, you docker exec -it web sh, look at the actual files nginx is serving, and spot the stale index.html in seconds. Then you fix the image so the next deploy is correct.

Warning: Changes made via exec live in the container's writable layer - they vanish when the container is removed and they're not in the image. exec is for diagnosis and emergency hotfixes, never for permanent configuration.

Housekeeping:

$ docker stop web     # graceful (SIGTERM, then SIGKILL after 10s)
$ docker rm web       # remove a stopped container
$ docker rm -f web    # stop + remove in one step