Docker events describe the activities taken by your Docker daemon. Most interactions with objects such as containers, images, volumes, and networks record an event, creating a log that you can use to inspect past changes.
There are many different kinds of event that identify specific changes in your environment:
Creating and removing containers
Container health check statuses
Commands executed inside containers with docker exec
Pulling and pushing images
Creating, destroying, mounting, and unmounting volumes
Enabling and disabling Docker daemon plugins
$ docker run --rm hello-world
Several events should now appear in the terminal window that’s running the docker events command:
Each event displays on its own line. The event timestamp is displayed first, followed by the type of object affected (such as image or container) and then the action that was taken (like create, attach, and start). The remainder of the message contains useful metadata about the object. The example above reveals that the hello-world:latest image was pulled and a container created from it.
The raw event list is often unwieldy. You can reformat the output using the –format flag which accepts a Go template string:
docker events --filter type=container //Get all events that relate to containers.
docker events --filter event=create // Get container creation events.
docker events --filter container=demo-container –// Get all the events saved for the container called demo-container (you can reference the container’s ID or name).
Besides container, you can filter by all supported object type names such as image, network, and volume.
Multiple filters are supported when you repeat the –filter flag. Distinct filters are interpreted as logical AND conditions; multiple uses of the same filter become OR clauses. Here’s an example which surfaces the create event for both the app-container and api-container containers:
docker events defaults to only showing events stored since the command’s been running. You can include historical events by adding the –since flag. This accepts a human-readable time expression or an absolute timestamp:
Events recorded after the given time will immediately be shown in your terminal. New events will continue to show up in real-time as they’re recorded.
You can exclude events after a particular time with the –until flag. It works similarly to –since. Using –until will disable real-time streaming of new events because they’d fall outside the requested timeframe.
Streaming Docker Events From the Daemon REST API
Another way to access stored events is through the Docker daemon REST API. You can use the /events endpoint to stream events in real-time after you’ve enabled the API on your Docker host. Events will be returned in JSON format: