Here’s a complete tutorial on docker events, explaining what it does, a complete list of examples, and use cases.

---

What is docker events?

docker events is a Docker command that provides a real-time stream of events happening on your Docker daemon. It tracks container lifecycle events (e.g., start, stop, create, kill), network changes, image pulls, and more.

Key Features:

• Monitors real-time activity on Docker.
• Helps with debugging, auditing, and automation.
• Supports filtering by event type, container name, image, and timestamp.

---

Basic Syntax

docker events [OPTIONS]

Common Options:

• --filter, -f: Filter events by specific criteria (container, image, event type, etc.).
• --since: Show events starting from a specific time (--since 10m for last 10 minutes).
• --until: Show events until a specific time (--until 2023-02-07T12:00:00).
• --format: Format the output using Go templates.

---

Examples of docker events

1. Show Real-Time Docker Events

docker events

This streams all Docker events in real-time.

Example Output:

2025-02-07T10:30:00.000000000Z container create a1b2c3d4e5f6 (name=my_container, image=nginx:latest)
2025-02-07T10:30:05.000000000Z container start a1b2c3d4e5f6 (name=my_container)
2025-02-07T10:35:00.000000000Z container stop a1b2c3d4e5f6 (name=my_container)

---

2. Filter Events by Container Name

docker events --filter "container=my_container"

This shows only events related to my_container.

---

3. Show Events for a Specific Image

docker events --filter "image=nginx"

This displays events triggered by any container running the nginx image.

---

4. Filter Events by Event Type (start, stop, create, etc.)

docker events --filter "event=start"

This shows only start events for containers.

---

5. Show Events from the Last 10 Minutes

docker events --since 10m

This displays events that occurred in the last 10 minutes.

---

6. Show Events Within a Time Range

docker events --since 2023-02-07T10:00:00 --until 2023-02-07T10:30:00

This shows events that occurred between 10:00 AM and 10:30 AM on February 7, 2023.

---

7. Use Custom Formatting for Output

docker events --format '{{json .}}'

This displays events in JSON format for easy parsing.

Example Output:

{"status":"create","id":"a1b2c3d4e5f6","from":"nginx:latest","Type":"container","time":1675773000}

---

8. Monitor and Log Events to a File

docker events --since 1h > docker_events.log

This saves all events from the last hour to a log file.

---

9. Watch Network Events

docker events --filter "type=network"

This shows events related to Docker networks (e.g., network creation, connection, and disconnection).

---

10. Monitor Events for Multiple Filters

docker events --filter "event=start" --filter "event=stop"

This displays only start and stop events for containers.

---

Use Cases for docker events

1. Real-Time Monitoring

• Monitor container lifecycle events to ensure services are running properly.
• Example: Detect when a container stops unexpectedly.

2. Debugging and Troubleshooting

• Track start, stop, and kill events to debug container issues.
• Example: Check if a container was killed due to resource limits or manually stopped.

3. Automation and Event-Driven Actions

• Integrate docker events with automation tools to trigger actions based on events.
• Example: Automatically restart a container when it stops.

4. Auditing and Security Monitoring

• Audit Docker activity to detect unauthorized image pulls, container creations, or deletions.
• Example: Monitor network changes to detect unexpected behavior.

5. Resource Management and Scaling

• Track CPU and memory usage spikes using external tools combined with docker events.
• Example: Trigger scaling actions based on high CPU usage.

6. Logging and Analytics

• Combine with centralized logging tools to build custom dashboards and reports.

---

List of Common docker events Commands

Command	Description
docker events	Show real-time Docker events
docker events --filter "container=my_container"	Filter events for a specific container
docker events --filter "image=nginx"	Show events for containers using the nginx image
docker events --filter "event=start"	Show only container start events
docker events --since 10m	Show events from the last 10 minutes
docker events --since 2025-02-07T10:00:00 --until 2025-02-07T10:30:00	Show events in a specific time range
docker events --filter "type=network"	Monitor network-related events
docker events --format '{{json .}}'	Show events in JSON format

---

Best Practices for Using docker events:

1. Use filtering (--filter) to avoid overwhelming output and focus on relevant events.
2. Combine with external monitoring tools (e.g., Prometheus, Grafana) for advanced alerting and dashboards.
3. Log events to a file for future reference or audits.
4. Automate recovery actions based on container events (e.g., restart a failed container).
5. Monitor network events to detect security incidents or misconfigurations.

---

Common Errors and Solutions

1. No output from docker events
   → Ensure that Docker is running. Use docker ps to verify.
2. Too many events
   → Use --filter and --since to reduce the output and focus on specific events.
3. Event data is hard to parse
   → Use --format '{{json .}}' for structured JSON output.

---

Combining docker events with Other Tools

1. Automate Recovery with a Shell Script

docker events --filter "event=die" | while read event; do
  docker start $(echo $event | grep -o -E '[a-z0-9]{12}')
done

Automatically restart any container that stops.

2. Monitor Events and Send Alerts

Integrate with tools like Prometheus, Grafana, or Slack to receive real-time alerts based on events.

---