The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
Start with docker ps -a, then follow a repeatable path through resource usage, processes, logs, configuration, events, disk usage, and Compose services. Docker’s command-line tools answer different operational questions: an inventory command cannot explain CPU pressure, and a log stream cannot show which process is consuming memory. Used together, these eight commands provide a practical terminal workflow for diagnosing container incidents.
The eight commands at a glance
| Command | Primary signal | Typical scope | Output mode | Useful automation |
|---|---|---|---|---|
docker ps |
Inventory and status | All or selected containers | Snapshot | Formatting and filters |
docker stats |
CPU, memory, I/O and PIDs | Running containers | Live stream or snapshot | --no-stream, --format |
docker top |
Processes inside one container | One container | Snapshot | Scriptable command output |
docker logs |
Container stdout and stderr | One container | Snapshot or follow stream | Timestamps and tail limits |
docker inspect |
Low-level state and configuration | One object | JSON or selected field | --format |
docker events |
Lifecycle events | Docker server, filterable | Real-time stream | Filters and redirection |
docker system df |
Docker disk consumption | Docker engine | Snapshot | Review before prune operations |
docker compose |
Multi-container application operations | Compose project | Snapshot or stream | Project-scoped subcommands |
The Docker CLI is designed as a command center for managing and monitoring containers, with output that can be used interactively or in scripts. The commands complement one another rather than duplicate one another.
1. Inventory containers with docker ps
Run:
docker psThis lists running containers and commonly shows the container ID, name, image, command, creation time, current status and published ports. To include stopped containers—essential when investigating crashes or restart loops—use:
docker ps -aEstablishing scope with docker ps -a is the first incident step. A container that is absent from the running list may have exited, while a container that repeatedly changes status needs the event and log commands below.
#1 Best Overall
2. Measure live resource usage with docker stats
docker stats returns a live data stream for running containers. It reports CPU, memory, network I/O, block I/O and process counts (PIDs):
docker statsFor a single comparable sample rather than a continuously updating terminal:
docker stats --no-streamInclude stopped-container context with -a when that is useful, and use --format when feeding the result to a script or collecting a narrow set of fields. On Linux, Docker’s CLI memory figure subtracts cache from total usage. Do not compare that number directly with a host-level metric without accounting for the different definitions.
Recommended Free Tools
Use the snapshot during an incident to identify an overloaded container, then use docker top and logs to determine what it is doing. A stream is suitable for an operator watching a terminal; it is not a retained time series.
3. See active processes with docker top
After identifying a suspicious container, inspect its process list:
docker top <container>The command displays processes running inside that container. It helps distinguish an application fault from a process or thread explosion. Compare the process list with the PID count shown by docker stats; a rapidly growing count warrants investigation of workers, child processes or an application loop.
4. Read application output with docker logs
Retrieve a container’s stdout and stderr with:
docker logs <container>During an incident, limit the volume and add timing information:
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstalldocker logs --tail 200 --timestamps <container>Follow new lines as they arrive with:
docker logs -f <container>Logs expose the container’s stdout/stderr stream. They do not automatically include every file the application writes inside the container filesystem. If the application logs only to files, use the application’s logging configuration or an appropriate volume-based collection method.
5. Inspect configuration and state with docker inspect
When status and logs are not enough, query the low-level object data:
docker inspect <container>The JSON response can reveal the image, mounts, networks, environment, restart policy and health metadata. For automation, extract a field with --format instead of parsing the complete response. For example, this prints a container’s restart policy:
docker inspect --format '{{json .HostConfig.RestartPolicy}}' <container>Inspect configuration when a container appears healthy but is connected to the wrong network, mounted data is missing, a health check is failing, or an unexpected restart policy is producing repeated launches.
6. Build a failure timeline with docker events
docker events reports real-time events from the Docker server:
docker eventsFilter by container, image or event type to reduce noise when building an incident timeline. The stream can show starts, stops, restarts and other lifecycle changes around a failure window. It is an event stream, not a historical metrics database. Redirect it or ship it to a logging system if you need retention beyond the terminal session.
7. Find Docker disk pressure with docker system df
Check Docker’s disk consumption before deleting anything:
docker system dfUse the result to identify pressure from images, containers, volumes and build cache. Treat pruning as a change operation, not a monitoring command: review what is unused and confirm that data is safe to remove before running any prune command. In particular, an apparently unused volume may contain recoverable application data.
8. Monitor a Compose application with docker compose
Compose provides project-scoped versions of the same operational checks:
docker compose ps
docker compose logs
docker compose stats
docker compose eventsUse up, restart and down for application lifecycle management. Compose also supports top, images, port and config workflows. Run these commands from the directory containing the project configuration, or supply the project’s Compose-file options as appropriate for your setup.
docker compose ps establishes which services are running; logs follows service output; stats streams service resource usage; and events provides a project-level lifecycle stream. This keeps an investigation aligned with service names instead of requiring you to assemble a list of individual container IDs.
A practical incident sequence
- Establish scope: run
docker ps -aand note running, exited and restarting containers. - Capture a baseline: run
docker stats --no-streamso the resource snapshot can be compared with later samples. - Check processes: run
docker top <container>on an overloaded or repeatedly restarting container. - Read recent output: run
docker logs --tail 200 --timestamps <container>; add-fwhen watching a live reproduction. - Verify configuration: use
docker inspectto check image, mounts, networks, restart policy and health metadata. - Review lifecycle changes: run filtered
docker eventsand correlate starts, stops or restarts with the failure window. - Check storage: run
docker system dfbefore deciding whether image, volume or build-cache pressure contributed. - Repeat at project scope: for Compose, use
docker compose ps,logs,statsandeventsso service relationships remain visible.
Choosing the right command quickly
- “What is running?” Use
docker psordocker ps -a. - “Which container is consuming CPU or memory?” Use
docker stats; remember the Linux cache subtraction. - “Which process is responsible?” Use
docker top. - “What did the application report?” Use
docker logs, with timestamps and a tail limit. - “How is this container configured?” Use
docker inspectand extract fields with--format. - “When did it restart?” Use filtered
docker events; retain the stream if a historical record is required. - “Why is Docker using so much disk?” Use
docker system dfbefore any cleanup. - “How is the whole application behaving?” Use the matching
docker composesubcommands.
Live terminal output versus retained monitoring
The CLI is excellent for immediate diagnosis. docker stats provides a live stream or one sample, while docker events provides real-time lifecycle notifications. Neither is a retained metrics database. If you need history, alerting or graphs, add a metrics stack. The Prometheus guide describes a Compose setup with Prometheus and cAdvisor; cAdvisor exposes container metrics that can be explored as graphs. Keep the CLI for fast, local investigation and use retained metrics for trends and post-incident analysis.
Performance, reliability and safety notes
- Prefer
--no-streamfor scripts that need one deterministic sample; an unbounded stream can keep a job running indefinitely. - Use
--formatto avoid brittle parsing of human-oriented tables. - Limit log output with
--tailduring incidents so a large history does not obscure the newest error. - Remember that
docker eventsis ephemeral unless redirected or shipped elsewhere. - Interpret Docker’s memory figure according to its Linux cache accounting before comparing it with host telemetry.
- Review
docker system dfbefore cleanup. Pruning can remove data that is not reproducible or replaceable. - Use Compose commands when service relationships matter; individual-container commands remain useful for a focused drill-down.
Common failures and fixes
The container is missing from docker ps
It may have exited. Run docker ps -a, then inspect its logs and configuration.
docker stats shows no useful history
That is expected: the command is a live stream or snapshot. Use Prometheus and cAdvisor, or another retained metrics system, for graphs and trends.
Memory numbers disagree with host monitoring
On Linux, Docker’s CLI memory figure subtracts cache. Confirm that the host metric uses a comparable definition before drawing conclusions.
Logs do not contain the expected message
docker logs reads stdout and stderr, not arbitrary files inside the container. Check where the application writes and how that path is collected.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteA restart loop is hard to explain
Capture docker events during the window, inspect restart policy and health metadata with docker inspect, and read timestamped logs.
Disk cleanup might delete needed data
Run docker system df first and review unused images, containers, volumes and build cache. Treat pruning as a deliberate change.
Or skip the browser setup
If you also need clean screenshots of a status page, runbook or Compose dashboard, ScreenshotNeo provides a website screenshot API and MCP server. A single request can return PNG, JPEG, WebP or PDF:
curl -G "https://api.screenshotneo.com/v1/shot" -d access_key=YOUR_API_KEY --data-urlencode url=https://stripe.com -o shot.webpSee the ScreenshotNeo documentation for options. Cookie or consent banners are accepted and removed before capture, along with more than 60 known consent platforms, newsletter popups and chat widgets; each cleanup step can be disabled. Bot checks, blank pages, timeouts, failed loads and cache hits are not billed, and response headers identify the page verdict and billing status. An MCP server provides take_screenshot, get_page_info and capture_pdf tools for Claude, Cursor and other MCP clients. The Free plan includes 1,000 screenshots per month with no card; paid plans start at $5 for 3,000 shots. Create a free ScreenshotNeo account.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
FAQ
Can these commands monitor containers on another host?
They query the Docker server selected by your CLI context. The commands themselves do not create a central, retained monitoring system.
Should I use docker logs or a logging platform?
Use docker logs for immediate stdout/stderr diagnosis. Forward logs elsewhere when you need retention, search across hosts or long-term analysis.
Is docker system df safe to run?
Yes, it reports usage. Cleanup commands are separate change operations and require review before execution.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
