Docker log management best practices, including Docker log analysis, Docker container logs, etc.

Some content sources:

• Container log collection practice

Docker logs are divided into two categories:

• Docker engine log (that is, the log when dockerd is running),
• Container logs, logs generated by services in the container.

1. Docker engine log (Docker Daemon log)

Docker engine logs are generally delivered to Upstart (Ubuntu 14.04) or systemd (CentOS 7, Ubuntu 16.04).

The former are generally located at /var/log/upstart/docker.log, by which we generally journalctl -u dockercome to view it.

Docker Daemon itself as a systemd service to start in Linux, and therefore can be sudo journalctl -u dockerused to view the log Daemon own command.

system	Log location
Ubuntu(14.04)	/var/log/upstart/docker.log
Ubuntu(16.04)	journalctl -u docker.service
CentOS 7/RHEL 7/Fedora	journalctl -u docker.service
CoreOS	journalctl -u docker.service
OpenSuSE	journalctl -u docker.service
OSX	~/Library/Containers/com.docker.docker/Data/com.docker.driver.amd64-linux/log/d?ocker.log
Debian GNU/Linux 7	/var/log/daemon.log
Debian GNU/Linux 8	journalctl -u docker.service
Boot2Docker	/var/log/docker.log

Second, the container log

By docker logs container_id|container_namecan see Docker containers output log, but logs here only contains the standard output of the container (STDOUT) and standard error (STDERR), suitable for some of the log to STDOUT container, such as the Nginx, see the nginx dockerfile found It is achieved by linking the log file to STDOUT and STDERR,

    RUN ln -sf /dev/stdout /var/log/nginx/access.log
    && ln -sf /dev/stderr /var/log/nginx/error.log

But if the inside of the container application log is output to the log file (such as Spring Boot project or Tomcat container, usually the log output to a log file), you can not through the docker logsview commands.

docker logsWill display the history log, log too much, then have to wait half a day to see the latest logs, but also cause some pressure on the Docker Daemon, can be used docker logs --tail 200 container_idto view the latest N bars or use docker logs -f container_id(like tail -f)

In a production environment, if our application outputs to our log files, we generally don't collect much important log information when using docker logs.

• The official nginx mirror uses a method to output the log to STDOUT, which is to create a symbolic link /var/log/nginx/access.logto it /dev/stdout.
• What httpd uses is to output it to the specified file, the normal log is output to /proc/self/fd/1(STDOUT), and the error log is output to /proc/self/fd/2(STDERR).

When the log volume is relatively large, we use docker logs to view the logs, which will put a lot of pressure on the docker daemon, and the container will cause a series of problems such as slow container creation.

Only use a local 、json-file、journaldlog-driven container before you can use docker logs capture log, using another log drive can not be useddocker logs .

2.1 Docker log driver (log processing mechanism)

When we start a container, it actually runs as a child process of Docker Daemon. Docker Daemon can get the standard output and standard error output of the process in the container, and then process it through Docker's Log Driver module. As shown below

Docker provides two modes for driving messages from containers to logs.

• (Default) Reject, block from container to container driver
• Non-blocking delivery, logs will be stored in the container's buffer.

When the buffer is full, the old logs will be discarded.

Log mode option in the control blocking(默认)or non-blocking, when set non-blockingto set max-buffer-sizeparameters (default 1MB).

Supported drivers

	description
none	The running container has no logs and docker logsdoes not return any output.
local	Logs are stored in a custom format, designed to minimize overhead.
json-file	The log format is JSON. Docker's default logging driver.
syslog	Write log messages syslog. The syslogdaemon must be running on the host.
journald	Write log messages journald. The journalddaemon must be running on the host.
gelf	Write log messages to Graylog Extended Log Format (GELF) endpoints, such as Graylog or Logstash.
fluentd	Write log messages fluentd(forward input). The fluentddaemon must be running on the host.
awslogs	Write log messages to Amazon CloudWatch Logs.
splunk	Use the HTTP event collector to write log messages splunk.
etwlogs	Write log messages as Event Tracing for Windows (ETW) events. Only applicable to Windows platform.
gcplogs	Write log messages to Google Cloud Platform (GCP) Logging.
logentries	Write log messages to Rapid7 Logentries.

Using the Docker-CE version, the docker logscommand only applies to the following drivers (the docker logs detailed explanation also mentioned earlier)

• local
• json-file
• journald

1558055133186

2.2 Common commands for Docker log driver

View the log driver currently set by the system

docker  info |grep  "Logging Driver"  / docker info --format '{
    
    {.LoggingDriver}}'

Log driver to view the settings of a single container

docker inspect  -f '{
    
    {.HostConfig.LogConfig.Type}}'   容器id

2.3 Docker logs drive global configuration changes

Modify the log driver and configure it in the configuration file /etc/docker/daemon.json(note that the content of the file is in JSON format).

Example:

{
    
    
    "log-driver": "local",
    "log-opts": {
    
    
        "max-size": "10m",
        "max-file": 3
    }
}

The above changes are log-driven for all containers. We can also set up a log driver for a single container separately.

Docker single container log driver configuration

Specify the log driver when running the container --log-driver.

docker  run  -itd --log-driver none alpine ash # 这里指定的日志驱动为 none 

Log driver one, local

localDriving the log records from the container STOUT/STDERRoutput and written to disk in the host.

By default, the local log driver reserves 100MB of log information for each container and enables automatic compression to save it. (After testing, keeping 100MB of logs means logs that are not compressed)

driving local log storage location /var/lib/docker/containers/容器id/local-logs/to container.lognamed.

Options supported by the local driver

Options	description	Sample value
max-size	The maximum size of the log before cutting. Possible values ​​are (k,m,g), and the default is 20m.	--log-opt max-size=10m
max-file	The maximum number of log files that can exist. If the maximum is exceeded, the oldest file will be deleted. **Only valid when max-size is set. The default is 5.	--log-opt max-file=3
compress	Corresponding to whether to enable compression for cutting log files. It is enabled by default.	--log-opt compress=false

The global log driver is set to -local

Configure in the configuration file /etc/docker/daemon.json(note that the content of the file is in JSON format).

{
    
    
  "log-driver": "local",
  "log-opts": {
    
    
    "max-size": "10m"
  }
}

Restart docker to take effect.

Single container log driver is set to -local

Run vessel and set to localthe drive.

#  运行一个容器 ，并设定日志驱动为 local ，并运行命令 ping www.baidu.com
[root@localhost docker]# docker run  -itd  --log-driver  local  alpine  ping www.baidu.com 
3795b6483534961c1d5223359ad1106433ce2bf25e18b981a47a2d79ad7a3156#  查看运行的容器的 日志驱动是否是 local
[root@localhost docker]# docker inspect  -f '{
    
    {.HostConfig.LogConfig.Type}}'   3795b6483534961c
local# 查看日志
[root@localhost local-logs]# tail -f  /var/lib/docker/containers/3795b6483534961c1d5223359ad1106433ce2bf25e18b981a47a2d79ad7a3156/local-logs/container.log 
NNdout????:64 bytes from 14.215.177.38: seq=816 ttl=55 time=5.320 ms
NNdout?μ???:64 bytes from 14.215.177.38: seq=817 ttl=55 time=4.950 ms

Note: After testing, when we generate a 100 MB log, there will be four compressed files and one container.log:

[root@localhost local-logs]# ls -l
total 32544
-rw-r-----. 1 root root 18339944 May 16 09:41 container.log
-rw-r-----. 1 root root  3698660 May 16 09:41 container.log.1.gz

So when more than 100MB of log files, log files will continue to be written container.log, but will container.loglog the old log deletion, addition of a new, that is, when filled with 100MB log, and then generate a new log, deletes container.logthe An old log saves 100MB in size. This will have some impact on us,

当我运行系统时 第一天由于bug产生了 100MB 日志，那么之前的日志就已经有 80MB 日志变成的压缩包，所以我在后续的运行中，只能获取最近的 20MB日志。

Log driver 2. The default log driver—JSON

The default log driver for all containers json-file .

json-fileDriving the log records from the container STOUT/STDERRoutput, with JSON format written to a file, the log contains not only the output log, as well as the time stamp, and output formats. The following is a ping www.baidu.comcorresponding log JSON

{"log":"64 bytes from 14.215.177.39: seq=34 ttl=55 time=7.067 ms\r\n","stream":"stdout","time":"2019-05-16T14:14:15.030612567Z"}

The path of the json-file log is located /var/lib/docker/containers/container_id/container_id-json.log.

json-file The log driver supports the following options:

Options	description	Sample value
max-size	The maximum size of the log before cutting. The available value unit is (k,m,g), and the default is -1 (indicating unlimited).	--log-opt max-size=10m
max-file	The maximum number of log files that can exist. If the cutting log creates more files than the threshold, the oldest file will be deleted. **Only valid when max-size is set. **Positive integer. The default is 1.	--log-opt max-file=3
labels	Applicable when starting the Docker daemon. A comma-separated list of tags related to logging that this daemon accepts.	--log-opt labels=production_status,geo
env	Applicable when starting the Docker daemon. A comma-separated list of environment variables related to logging accepted by this daemon.	--log-opt env=os,customer
env-regex	Similar and compatible env. Regular expression used to match environment variables related to logging.	--log-opt env-regex=^(os|customer).
compress	Whether the cut log is compressed. The default is disabled.	--log-opt compress=true

json-file Log-driven example

# 设置 日志驱动为 json-file ，我们也可以不设置，因为默认就是 json-file
docker run  -itd  --name  test-log-json  --log-driver json-file   alpine  ping www.baidu.com
199608b2e2c52136d2a17e539e9ef7fbacf97f1293678aded421dadbdb006a5e

# 查看日志,日志名称就是 容器名称-json.log
tail -f /var/lib/docker/containers/199608b2e2c52136d2a17e539e9ef7fbacf97f1293678aded421dadbdb006a5e/199608b2e2c52136d2a17e539e9ef7fbacf97f1293678aded421dadbdb006a5e-json.log

{
    
    "log":"64 bytes from 14.215.177.39: seq=13 ttl=55 time=15.023 ms\r\n","stream":"stdout","time":"2019-05-16T14:13:54.003118877Z"}
{
    
    "log":"64 bytes from 14.215.177.39: seq=14 ttl=55 time=9.640 ms\r\n","stream":"stdout","time":"2019-05-16T14:13:54.999011017Z"}

Log driver three, syslog

The syslog log driver routes the logs to the syslog server. syslog uses the original string as the log message metadata. The receiver can extract the following messages:

• level log level, such as debug, warning, error, info.
• timestamp 时间戳
• hostname 事件发生的主机
• facillty 系统模块
• 进程名称和进程 ID

syslog 日志驱动全局配置

编辑 /etc/docker/daemon.json 文件

{
    
    
  "log-driver": "syslog",
  "log-opts": {
    
    
    "syslog-address": "udp://1.2.3.4:1111"
  }
}

重启 docker 即可生效。

Option	Description	Example value
syslog-address	指定syslog 服务所在的服务器和使用的协议和端口。格式：[tcp|udp|tcp+tls]://host:port,unix://path, orunixgram://path. 默认端口是 514.	--log-opt syslog-address=tcp+tls://192.168.1.3:514, --log-opt syslog-address=unix:///tmp/syslog.sock
syslog-facility	使用的 syslog 的设备， 具体设备名称见 syslog documentation.	--log-opt syslog-facility=daemon
syslog-tls-ca-cert	如果使用的是 tcp+tls的地址，指定CA 证书的地址，如果没有使用，则不设置该选项。	--log-opt syslog-tls-ca-cert=/etc/ca-certificates/custom/ca.pem
syslog-tls-cert	如果使用的是 tcp+tls的地址，指定 TLS 证书的地址，如果没有使用，则不设置该选项。	--log-opt syslog-tls-cert=/etc/ca-certificates/custom/cert.pem
syslog-tls-key	如果使用的是 tcp+tls的地址，指定 TLS 证书 key的地址，如果没有使用，则不设置该选项。**	--log-opt syslog-tls-key=/etc/ca-certificates/custom/key.pem
syslog-tls-skip-verify	如果设置为 true ，会跳过 TLS 验证，默认为 false	--log-opt syslog-tls-skip-verify=true
tag	将应用程序的名称附加到 syslog 消息中，默认情况下使用容器ID的前12位去 标记这个日志信息。	--log-opt tag=mailer
syslog-format	syslog 使用的消息格式 如果未指定则使用本地 UNIX syslog 格式，rfc5424micro 格式具有微妙时间戳。	--log-opt syslog-format=rfc5424micro
labels	启动 docker 时，配置与日志相关的标签，以逗号分割	--log-opt labels=production_status,geo
env	启动 docker 时，指定环境变量用于日志中，以逗号分隔	--log-opt env=os,customer
env-regex	类似并兼容 env，	--log-opt env-regex=^(os\|customer)

单个容器日志驱动设置为—syslog

Linux 系统中 我们用的系统日志模块时 rsyslog ，它是基于syslog 的标准实现。我们要使用 syslog 驱动需要使用 系统自带的 rsyslog 服务。

# 查看当前 rsyslog 版本和基本信息
[root@localhost harbor]# rsyslogd  -v
rsyslogd 8.24.0, compiled with:
    PLATFORM:               x86_64-redhat-linux-gnu
    PLATFORM (lsb_release -d):      
    FEATURE_REGEXP:             Yes
    GSSAPI Kerberos 5 support:      Yes
    FEATURE_DEBUG (debug build, slow code): No
    32bit Atomic operations supported:  Yes
    64bit Atomic operations supported:  Yes
    memory allocator:           system default
    Runtime Instrumentation (slow code):    No
    uuid support:               Yes
    Number of Bits in RainerScript integers: 64

See http://www.rsyslog.com for more information.

配置 syslog , 在配置文件 /etc/rsyslog.conf 大约14-20行，我们可以看到两个配置，一个udp，一个tcp ，都是监听 514 端口，提供 syslog 的接收。选择 tcp 就将 tcp 的两个配置的前面 # 号注释即可。

# Provides UDP syslog reception
#$ModLoad imudp
#$UDPServerRun 514

# Provides TCP syslog reception
#$ModLoad imtcp  
#$InputTCPServerRun 514

然后重启 rsyslog，我们可以看到514端口在监听。

systemctl restart  rsyslog
[root@localhost harbor]# netstat -ntul |grep 514
tcp        0      0 0.0.0.0:514             0.0.0.0:*               LISTEN     
tcp6       0      0 :::514                  :::*                    LISTEN  

启动一个以 syslog 为驱动的容器。

docker  run -d -it  -p 87:80 --log-driver syslog --log-opt syslog-address=tcp://127.0.0.1:514  --name nginx-syslog   nginx

访问并查看日志

# 访问nginx
curl 127.0.0.1:87
# 查看访问日志
tail -f  /var/log/messages
May 17 15:56:48 localhost fe18924aefde[6141]: 172.17.0.1 - - [17/May/2019:07:56:48 +0000] "GET / HTTP/1.1" 200 612 "-" "curl/7.29.0" "-"#015
May 17 15:58:16 localhost fe18924aefde[6141]: 172.17.0.1 - - [17/May/2019:07:58:16 +0000] "GET / HTTP/1.1" 200 612 "-" "curl/7.29.0" "-"#015

日志驱动 四、Journald

journald 日志驱动程序将容器的日志发送到 systemd journal, 可以使用 journal API 或者使用 docker logs 来查日志。

除了日志本身以外， journald 日志驱动还会在日志加上下面的数据与消息一起储存。

Field	Description
CONTAINER_ID	容器ID,为 12个字符
CONTAINER_ID_FULL	完整的容器ID，为64个字符
CONTAINER_NAME	启动时容器的名称，如果容器后面更改了名称，日志中的名称不会更改。
CONTAINER_TAG, SYSLOG_IDENTIFIER	容器的tag.
CONTAINER_PARTIAL_MESSAGE	当日志比较长的时候使用标记来表示(显示日志的大小)

选项

选项	是否必须	描述
tag	可选的	指定要在日志中设置CONTAINER_TAG和SYSLOG_IDENTIFIER值的模板。
labels	可选的	以逗号分隔的标签列表，如果为容器指定了这些标签，则应包含在消息中。
env	可选的	如果为容器指定了这些变量，则以逗号分隔的环境变量键列表（应包含在消息中）。
env-regex	可选的	与env类似并兼容。用于匹配与日志记录相关的环境变量的正则表达式 。

journald 日志驱动全局配置

编辑 /etc/docker/daemon.json 文件

{
    
    
  "log-driver": "journald"
}

单个容器日志驱动设置为—****journald

docker  run  -d -it --log-driver=journald \
    --log-opt labels=location \
    --log-opt env=TEST \
    --env "TEST=false" \
    --label location=china \
    --name  nginx-journald\
    -p 80:80\
    nginx

查看日志 journalctl

# 只查询指定容器的相关消息
 journalctl CONTAINER_NAME=webserver
# -b 指定从上次启动以来的所有消息
 journalctl -b CONTAINER_NAME=webserver
# -o 指定日志消息格式，-o json 表示以json 格式返回日志消息
 journalctl -o json CONTAINER_NAME=webserver
# -f 一直捕获日志输出
 journalctl -f CONTAINER_NAME=webserver

如果我们的容器在启动的时候加了 -t 参数，启用了 TTY 的话，那么我查看日志是会像下面一样

May 17 17:19:26 localhost.localdomain 2a338e4631fe[6141]: [104B blob data]
May 17 17:19:32 localhost.localdomain 2a338e4631fe[6141]: [104B blob data]

显示[104B blob data] 而不是完整日志原因是因为有 \r 的存在，如果我们要完整显示，需要加上参数 --all 。

三、 生产环境中该如何储存容器中的日志

我们在上面看到了 Docker 官方提供了 很多日志驱动，但是上面的这些驱动都是针对的 标准输出的日志驱动。

3.1 容器日志分类

容器的日志实际是有两大类的：

• 标准输出的 ，也就是 STDOUT 、STDERR ,这类日志我们可以通过 Docker 官方的日志驱动进行收集。

  示例：Nginx 日志，Nginx 日志有 access.log 和 error.log ，我们在 Docker Hub 上可以看到 Nginx 的 dockerfile 对于这两个日志的处理是：

  RUN ln -sf /dev/stdout /var/log/nginx/access.log \
    && ln -sf /dev/stderr /var/log/nginx/error.log
  

  都软连接到 /dev/stdout 和 /dev/stderr ，也就是标准输出，所以这类 容器是可以使用 Docker 官方的日志驱动。

• 文本日志，存在在于容器内部，并没有重定向到 容器的标准输出的日志。

  示例：Tomcat 日志，Tomcat 有 catalina、localhost、manager、admin、host-manager，我们可以在 Docker Hub 看到 Tomcat 的 dockerfile 只有对于 catalina 进行处理，其它日志将储存在容器里。

  CMD ["catalina.sh", "run"]
  

  我们运行了一个 Tomcat 容器 ，然后进行访问后，并登陆到容器内部，我们可以看到产生了文本日志：

  root@25ba00fdab97:/usr/local/tomcat/logs# ls -l
  total 16
  -rw-r-----. 1 root root 6822 May 17 14:36 catalina.2019-05-17.log
  -rw-r-----. 1 root root    0 May 17 14:36 host-manager.2019-05-17.log
  

  这类容器我们下面有专门的方案来应对。

3.2 当是完全是标准输出的类型的容器

选择 json-file 、syslog、local 等 Docker 支持的日志驱动。

3.3 当有文件文本日志的类型容器

方案一 挂载目录 bind

创建一个目录，将目录挂载到 容器中产生日志的目录。

--mount  type=bind,src=/opt/logs/,dst=/usr/local/tomcat/logs/ 

示例：

# 创建挂载目录/opt/logs
[root@fy-local-2 /]# mkdir  /opt/logs
# 创建容器tomcat-bind 并将 /opt/logs 挂载至 /usr/local/tomcat/logs/
[root@fy-local-2 /]# docker  run -d  --name  tomcat-bind  -P  --mount  type=bind,src=/opt/logs/,dst=/usr/local/tomcat/logs/   tomcat 
[root@fy-local-2 /]# ls -l /opt/logs/
total 12
-rw-r----- 1 root root 6820 May 22 17:31 catalina.2019-05-22.log
-rw-r----- 1 root root    0 May 22 17:31 host-manager.2019-05-22.log

方案二 使用数据卷 volume

创建数据卷，创建容器时绑定数据卷，

--mount  type=volume  src=volume_name  dst=/usr/local/tomcat/logs/ 

示例：

# 创建tomcat应用数据卷名称为 tomcat
[root@fy-local-2 /]# docker volume  create  tomcat
# 创建容器tomcat-volume 并指定数据卷为 tomcat，绑定至 /usr/local/tomcat/logs/
[root@fy-local-2 /]# docker  run -d  --name  tomcat-volume   -P  --mount  type=volume,src=tomcat,dst=/usr/local/tomcat/logs/   tomcat
# 查看数据卷里面的内容
[root@fy-local-2 /]# ls -l /var/lib/docker/volumes/tomcat/_data/
total 12
-rw-r----- 1 root root 6820 May 22 17:33 catalina.2019-05-22.log
-rw-r----- 1 root root    0 May 22 17:33 host-manager.2019-05-22.log

方案三 计算容器 rootfs 挂载点

此方案的文字内容摘抄于 https://yq.aliyun.com/articles/672054

使用挂载宿主机目录的方式采集日志对应用会有一定的侵入性，因为它要求容器启动的时候包含挂载命令。如果采集过程能对用户透明那就太棒了。事实上，可以通过计算容器 rootfs 挂载点来达到这种目的。

和容器 rootfs 挂载点密不可分的一个概念是 storage driver。实际使用过程中，用户往往会根据 linux 版本、文件系统类型、容器读写情况等因素选择合适的 storage driver。不同 storage driver 下，容器的 rootfs 挂载点遵循一定规律，因此我们可以根据 storage driver 的类型推断出容器的 rootfs 挂载点，进而采集容器内部日志。下表展示了部分 storage dirver 的 rootfs 挂载点及其计算方法。

Storage driver	rootfs 挂载点	计算方法
aufs	/var/lib/docker/aufs/mnt/	id 可以从如下文件读到。 /var/lib/docker/image/aufs/layerdb/mounts/<container-id>/mount-id
overlay	/var/lib/docker/overlay//merged	完整路径可以通过如下命令得到。 docker inspect -f '{ {.GraphDriver.Data.MergedDir}}' <container-id>
overlay2	/var/lib/docker/overlay2//merged	完整路径可以通过如下命令得到。 docker inspect -f '{ {.GraphDriver.Data.MergedDir}}' <container-id>
devicemapper	/var/lib/docker/devicemapper/mnt//rootfs	id 可以通过如下命令得到。 docker inspect -f '{ {.GraphDriver.Data.DeviceName}}' <container-id>

示例：

# 创建容器 tomcat-test
[root@fy-local-2 /]# docker  run -d  --name  tomcat-test  -P  tomcat
36510dd653ae7dcac1d017174b1c38b3f9a226f9c4e329d0ff656cfe041939ff  
# 查看tomcat-test 容器的 挂载点位置
[root@fy-local-2 /]# docker inspect -f '{
    
    {.GraphDriver.Data.MergedDir}}' 36510dd653ae7dcac1d017174b1c38b3f9a226f9c4e329d0ff656cfe041939ff  
/var/lib/docker/overlay2/c10ec54bab8f3fccd2c5f1a305df6f3b1e53068776363ab0c104d253216b799d/merged
# 查看挂载点的目录结构
[root@fy-local-2 /]# ls -l /var/lib/docker/overlay2/c10ec54bab8f3fccd2c5f1a305df6f3b1e53068776363ab0c104d253216b799d/merged
total 4
drwxr-xr-x 1 root root  179 May  8 13:05 bin
drwxr-xr-x 2 root root    6 Mar 28 17:12 boot
drwxr-xr-x 1 root root   43 May 22 17:27 dev
lrwxrwxrwx 1 root root   33 May  8 13:08 docker-java-home -> /usr/lib/jvm/java-8-openjdk-amd64
drwxr-xr-x 1 root root   66 May 22 17:27 etc
# 查看日志
[root@fy-local-2 /]# ls -l /var/lib/docker/overlay2/c10ec54bab8f3fccd2c5f1a305df6f3b1e53068776363ab0c104d253216b799d/merged/usr/local/tomcat/logs/
total 20
-rw-r----- 1 root root 14514 May 22 17:40 catalina.2019-05-22.log
-rw-r----- 1 root root     0 May 22 17:27 host-manager.2019-05-22.log

方案四 在代码层中实现直接将日志写入redis

docker ——》redis ——》Logstash——》Elasticsearch，通过代码层面，直接将日志写入redis,最后写入 Elasticsearch。

以上就是对 Docker 日志的所有的概念解释和方提供，具体采用什么方案，根据公司的具体的业务来选择。合适的才是最好的。

四、查看docker日志API示例

docker logs [OPTIONS] CONTAINER ID

OPTIONS说明：

-f : 跟踪日志输出
--since :显示某个开始时间的所有日志
-t : 显示时间戳
--tail :仅列出最新N条容器日志

4.1 查看指定时间后的日志，只显示最后100行：

docker logs -f -t --since="2020-10-01" --tail=100 CONTAINER ID

4.2 查个指定时间区段的日志

docker logs -t --since="2020-10-01T19:00:00" --until "2020-10-01T19:00:00" CONTAINER ID

4.3 查看指定时间后面的日志：

docker logs -t --since="2020-10-01T19:00:00" CONTAINER ID

4.4 查看最近5分钟的日志:

docker logs --since 5m CONTAINER ID

4.5 Execute bash on the specified container through the exec command:

docker exec hellolearn -it /bin/bash `或者` docker exec -it hellolearn bash

4.6 View docker IP

docker inspect --format='{
    
    {.NetworkSettings.IPAddress}}' hellolearn