Everyone uses Docker, but almost no one knows how to really debug a container.
No, I’m not talking about the usual suspects:
`docker logs` → often empty or useless
`docker inspect` → static snapshot
`docker exec` → can’t attach before the container dies
Sound familiar?
When your container crashes in production (but works fine locally), you end up in a loop: tweaking the Dockerfile, redeploying, and praying.
But there’s a better way.
Enter docker events – The Secret Weapon
This little-known command streams real-time, low-level events straight from the Docker daemon. It exposes what docker logs won’t tell you.
Example:
Your container keeps restarting. The logs show nothing. Instead of guessing, run:
docker events --filter container=<your_container_id>
Output:
2025-05-04T18:20:01Z container create ...
2025-05-04T18:20:02Z container start ...
2025-05-04T18:20:03Z container health_status: unhealthy ...
2025-05-04T18:20:04Z container kill signal=SIGTERM
2025-05-04T18:20:04Z container restart
Boom. Now you see:
- Health check failed → Container killed → Docker auto-restarted it Your app logs? They won’t show this. The health check runs outside your main process.
Pro Tips:
- Filter by time:
docker events --filter contaner=<container-id> --since="30m" --until "2025-05-04T18:00:00"
Structured JSON output:
docker events --filter container=<cont_id> --since="5m" --format '{{json .}}' | jq
But What About Observability Tools?
Sure, Grafana, Prometheus, and Loki are great. But they won’t catch:
- OOM kills before metrics are scraped
- Failed volume mounts
- Init containers that crash silently
- Sidecars restarting in the background
docker events sees everything—in real time.
If you’re debugging Docker without it, you’re not debugging. You’re guessing.
Top comments (0)