The logs commands is pretty self explanatory; it allows you to interact with the stdout stream of your containers, which Docker is keeping track of in the background. For example, to view the last entries written to stdout for our nginx-test container, I just need to use the following command:

$ docker container logs --tail 5 nginx-test

The output of the command is shown here:

To view the logs in real time, I simply need to run the following:

$ docker container logs -f nginx-test

The -f flag is shorthand for --follow. I can also, say, view everything that has been logged since 15:00 today by running the following:

$ docker container logs --since 2017-06-24T15:00 nginx-test 

The output of the command is shown here:

You might notice in the preceding output that the timestamp in the access log is 14:34, which is before 15:00. Why is that?

The logs command shows the timestamps of stdout recorded by Docker and not the time within the container. You can see this from when I run the following commands:

$ date
$ docker container exec nginx-test date

The output is shown here:

There is an hour's time difference between my host machine and the container due to British Summer Time (BST) being in effect on my host.

Luckily, to save confusion--or add to it, depending on how you look at it--you can add -t to your logs commands:

$ docker container logs --since 2017-06-24T15:00 -t nginx-test

The -t flag is short for --timestamp; this option prepends the time the output was captured by Docker: