The Docker engine, when creating, running, stopping, and removing containers and other resources such as volumes or networks, produces a log of events. These events can be consumed by external systems, such as some infrastructure services that use them to make informed decisions. An example of such a service could be a tool that creates an inventory of all containers that are currently running on the system.
We can hook ourselves into this stream of system events and output them, for example in a terminal, by using the following command:
$ docker system events
This command is a blocking command. Thus, when you execute it in your terminal session the according session is blocked. Therefore, we recommend that you always open an extra window when you want to use this command.
Assuming we have executed the preceding command in an extra terminal window, we can now test it and run a container like this:
$ docker container run --rm alpine echo "Hello World"
The output produced should look like this:
2018-01-28T15:08:57.318341118-06:00 container create 8e074342ef3b20cfa73d17e4ef7796d424aa8801661765ab5024acf166c6ecf3 (image=alpine, name=confident_hopper)
2018-01-28T15:08:57.320934314-06:00 container attach 8e074342ef3b20cfa73d17e4ef7796d424aa8801661765ab5024acf166c6ecf3 (image=alpine, name=confident_hopper)
2018-01-28T15:08:57.354869473-06:00 network connect c8fd270e1a776c5851c9fa1e79927141a1e1be228880c0aace4d0daebccd190f (container=8e074342ef3b20cfa73d17e4ef7796d424aa8801661765ab5024acf166c6ecf3, name=bridge, type=bridge)
2018-01-28T15:08:57.818494970-06:00 container start 8e074342ef3b20cfa73d17e4ef7796d424aa8801661765ab5024acf166c6ecf3 (image=alpine, name=confident_hopper)
2018-01-28T15:08:57.998941548-06:00 container die 8e074342ef3b20cfa73d17e4ef7796d424aa8801661765ab5024acf166c6ecf3 (exitCode=0, image=alpine, name=confident_hopper)
2018-01-28T15:08:58.304784993-06:00 network disconnect c8fd270e1a776c5851c9fa1e79927141a1e1be228880c0aace4d0daebccd190f (container=8e074342ef3b20cfa73d17e4ef7796d424aa8801661765ab5024acf166c6ecf3, name=bridge, type=bridge)
2018-01-28T15:08:58.412513530-06:00 container destroy 8e074342ef3b20cfa73d17e4ef7796d424aa8801661765ab5024acf166c6ecf3 (image=alpine, name=confident_hopper)
In this output, we can follow the exact life cycle of the container. The container is created, started, and then destroyed. If the output generated by this command is not to your liking you can always change it by using the --format parameter. The value of the format has to be written using the Go template syntax. The following sample outputs the type, image, and action of the event:
$ docker system events --format 'Type={{.Type}} Image={{.Actor.Attributes.image}} Action={{.Action}}'
If we run the exact same container run command as before, the output generated now looks like this:
Type=container Image=alpine Action=create
Type=container Image=alpine Action=attach
Type=network Image=<no value> Action=connect
Type=container Image=alpine Action=start
Type=container Image=alpine Action=die
Type=network Image=<no value> Action=disconnect
Type=container Image=alpine Action=destroy