Docker commands Guide – docker events with examples

Here’s a complete tutorial on docker events, explaining what it does, a complete list of examples, and use cases.

What is docker events?

docker events is a Docker command that provides a real-time stream of events happening on your Docker daemon. It tracks container lifecycle events (e.g., start, stop, create, kill), network changes, image pulls, and more.

Key Features:

• Monitors real-time activity on Docker.
• Helps with debugging, auditing, and automation.
• Supports filtering by event type, container name, image, and timestamp.

Basic Syntax

docker events [OPTIONS]
Code language: CSS (css)

Common Options:

• --filter, -f: Filter events by specific criteria (container, image, event type, etc.).
• --since: Show events starting from a specific time (--since 10m for last 10 minutes).
• --until: Show events until a specific time (--until 2023-02-07T12:00:00).
• --format: Format the output using Go templates.

Examples of docker events

1. Show Real-Time Docker Events

docker events

This streams all Docker events in real-time.

Example Output:

2026-02-07T10:30:00.000000000Z container create a1b2c3d4e5f6 (name=my_container, image=nginx:latest)
2026-02-07T10:30:05.000000000Z container start a1b2c3d4e5f6 (name=my_container)
2026-02-07T10:35:00.000000000Z container stop a1b2c3d4e5f6 (name=my_container)

2. Filter Events by Container Name

docker events --filter "container=my_container"
Code language: JavaScript (javascript)

This shows only events related to my_container.

3. Show Events for a Specific Image

docker events --filter "image=nginx"
Code language: JavaScript (javascript)

This displays events triggered by any container running the nginx image.

4. Filter Events by Event Type (start, stop, create, etc.)

docker events --filter "event=start"
Code language: JavaScript (javascript)

This shows only start events for containers.

5. Show Events from the Last 10 Minutes

docker events --since 10m

This displays events that occurred in the last 10 minutes.

6. Show Events Within a Time Range

docker events --since 2023-02-07T10:00:00 --until 2023-02-07T10:30:00
Code language: CSS (css)

This shows events that occurred between 10:00 AM and 10:30 AM on February 7, 2023.

7. Use Custom Formatting for Output

docker events --format '{{json .}}'
Code language: JavaScript (javascript)

This displays events in JSON format for easy parsing.

Example Output:

{"status":"create","id":"a1b2c3d4e5f6","from":"nginx:latest","Type":"container","time":1675773000}
Code language: JSON / JSON with Comments (json)

8. Monitor and Log Events to a File

docker events --since 1h > docker_events.log
Code language: CSS (css)

This saves all events from the last hour to a log file.

9. Watch Network Events

docker events --filter "type=network"
Code language: JavaScript (javascript)

This shows events related to Docker networks (e.g., network creation, connection, and disconnection).

10. Monitor Events for Multiple Filters

docker events --filter "event=start" --filter "event=stop"
Code language: JavaScript (javascript)

This displays only start and stop events for containers.

Use Cases for docker events

1. Real-Time Monitoring

• Monitor container lifecycle events to ensure services are running properly.
• Example: Detect when a container stops unexpectedly.

2. Debugging and Troubleshooting

• Track start, stop, and kill events to debug container issues.
• Example: Check if a container was killed due to resource limits or manually stopped.

3. Automation and Event-Driven Actions

• Integrate docker events with automation tools to trigger actions based on events.
• Example: Automatically restart a container when it stops.

4. Auditing and Security Monitoring

• Audit Docker activity to detect unauthorized image pulls, container creations, or deletions.
• Example: Monitor network changes to detect unexpected behavior.

5. Resource Management and Scaling

• Track CPU and memory usage spikes using external tools combined with docker events.
• Example: Trigger scaling actions based on high CPU usage.

6. Logging and Analytics

• Combine with centralized logging tools to build custom dashboards and reports.

List of Common docker events Commands

Best Practices for Using docker events:

1. Use filtering (--filter) to avoid overwhelming output and focus on relevant events.
2. Combine with external monitoring tools (e.g., Prometheus, Grafana) for advanced alerting and dashboards.
3. Log events to a file for future reference or audits.
4. Automate recovery actions based on container events (e.g., restart a failed container).
5. Monitor network events to detect security incidents or misconfigurations.

Common Errors and Solutions

1. No output from docker events
   → Ensure that Docker is running. Use docker ps to verify.
2. Too many events
   → Use --filter and --since to reduce the output and focus on specific events.
3. Event data is hard to parse
   → Use --format '{{json .}}' for structured JSON output.

Combining docker events with Other Tools

1. Automate Recovery with a Shell Script

docker events --filter "event=die" | while read event; do
  docker start $(echo $event | grep -o -E '[a-z0-9]{12}')
done
Code language: PHP (php)

Automatically restart any container that stops.

2. Monitor Events and Send Alerts

Integrate with tools like Prometheus, Grafana, or Slack to receive real-time alerts based on events.

Rajesh Kumar

I’m Rajesh Kumar, a DevOps, SRE, DevSecOps, Cloud, and Platform Engineering expert passionate about sharing practical knowledge, real-world experiences, and industry best practices. I have worked at Cotocus and regularly write about technology, travel, investing, health, product reviews, and digital marketing through my various platforms.

I publish technical articles at DevOps School, travel stories at Holiday Landmark, stock market insights at Stocks Mantra, health and fitness guidance at My Medic Plus, product reviews at TrueReviewNow, and SEO and digital marketing strategies at Wizbrand.