Docker Config Reference (docker events)

Example 1

docker events

This command streams all real-time events from the Docker daemon indefinitely, displaying actions such as container creations, starts, stops, and image operations, which is suitable for general monitoring of system-wide Docker activity.

Example 2

docker events --filter "event=start"

This command filters events to show only container start actions, enabling focused observation of when containers become active in a dynamic environment.

Example 3

docker events --filter "type=container"

This command restricts output to container-related events, such as attach, commit, or die, which is useful for tracking container lifecycle in isolation from other resource types.

Example 4

docker events --filter "container=myapp"

This command monitors events specific to the container named "myapp", providing targeted insights into its status changes like restarts or health checks.

Example 5

docker events --since "2025-12-01"

This command displays events occurring since December 1, 2025, allowing retrospective analysis of historical activity up to the present moment.

Example 6

docker events --until "2025-12-30T12:00:00"

This command shows events up to the specified timestamp on December 30, 2025, at noon, facilitating review of a defined time window for auditing purposes.

Example 7

docker events --format "{{.ID}} {{.Type}} {{.Action}}"

This command formats event output to include only the ID, type, and action, creating a concise, customizable log for scripting or integration with monitoring tools.

Example 8

docker events --format "table {{.From}} {{.Status}}"

This command presents events in a tabular format, showing the source (From) and status, enhancing readability for human review of system changes.

Example 9

docker events --filter "event=stop" --filter "type=container"

This command combines filters to display only container stop events, which is ideal for detecting shutdown patterns in multi-container applications.

Example 10

docker events --filter "image=nginx:latest"

This command tracks events related to the "nginx:latest" image, such as pulls, tags, or deletions, supporting image management workflows.

Example 11

docker events --filter "type=network"

This command focuses on network events, like connect or disconnect, aiding in diagnosing connectivity issues within Docker networks.

Example 12

docker events --filter "type=volume"

This command monitors volume-related events, such as mount or unmount, which is essential for tracking data persistence operations.

Example 13

docker events --since "1h ago" --until "now"

This command retrieves events from the last hour up to the current time, providing a recent activity snapshot for immediate troubleshooting.

Example 14

docker events --format "{{json .}}"

This command outputs events in JSON format, enabling easy parsing by external tools or scripts for automated event processing.

Example 15

docker events --filter "event=create" --filter "type=service"

This command filters for service creation events in Swarm mode, assisting in monitoring orchestration changes in clustered environments.

Example 16

docker events --filter "event=update" --filter "type=node"

This command tracks node update events in a Swarm cluster, which is critical for maintaining awareness of infrastructure modifications.

Example 17

docker events --filter "label=com.example.app=web"

This command filters events for objects with the label "com.example.app=web", allowing targeted tracking in labeled resource setups.

Example 18

docker events --since "2025-12-29" --format "{{.Time}} {{.Action}}"

This command lists events since December 29, 2025, formatted with timestamps and actions, supporting chronological analysis.

Example 19

docker events --filter "daemon=true"

This command displays daemon-level events, such as reloads or errors, providing insights into the Docker engine's internal operations.

Example 20

docker events --filter "plugin=true"

This command monitors plugin events, like activations or deactivations, which is useful for managing Docker extensions.

Example 21

docker events --filter "scope=swarm"

This command filters for Swarm-scoped events, encompassing cluster-wide actions like task allocations, in distributed systems.

Example 22

docker events --filter "scope=local"

This command restricts to local-scope events, focusing on single-host activities excluding Swarm-wide occurrences.

Example 23

docker events --until "5m ago"

This command shows events up to five minutes ago, enabling review of very recent history without ongoing streaming.

Example 24

docker events --format "table {{.ID}}\t{{.Type}}\t{{.Action}}\t{{.Actor.Attributes.name}}"

This command tabulates events with ID, type, action, and actor name, enhancing structured visibility for complex logs.

Example 25

docker events --filter "event=die" --filter "container=criticalapp"

This command tracks die events for the "criticalapp" container, alerting to unexpected terminations in critical services.

Example 26

docker events --filter "type=secret"

This command monitors secret-related events, such as creations or updates, crucial for security auditing in Swarm.

Example 27

docker events --filter "type=config"

This command focuses on config events, like modifications, supporting configuration management in orchestrated setups.

Example 28

docker events --since "2025-12-30T00:00:00" --until "2025-12-30T23:59:59"

This command retrieves all events for December 30, 2025, providing a full-day summary for daily reporting.

Example 29

docker events --filter "event=pull" --filter "image=alpine"

This command tracks pull events for the "alpine" image, verifying image download activities.

Example 30

docker events --format "{{.TimeNano}} {{.From}} {{.Status}}"

This command formats events with nanosecond timestamps, source, and status, for high-precision timing analysis.