Show Docker Container Logs Since a Time with --since

A service misbehaved a few minutes ago and you want only the logs from then on.

docker run -d --name since-demo alpine:3.20 sh -c 'echo early; sleep 5; echo late; sleep 60' > /dev/null
sleep 7
docker logs --since 4s since-demo
echo "--- everything"
docker logs since-demo
docker rm -f since-demo > /dev/null

late
--- everything
early
late

--since accepts a relative duration such as 4s, 10m or 2h, or an absolute time in RFC 3339 form. The container in the run printed early immediately and late five seconds later; asked seven seconds after start with --since 4s, docker logs returned only late, and the plain command returned both. --until closes the range from the other end. See docker container logs.

The cut is made on the time Docker recorded for each line, not on any time inside the message. Add -t to see those timestamps and check the boundary. Lines that Docker received just before the cutoff may fall on either side when the clocks of the client and daemon differ.