Problem

You've just SSH'd into a server you've never worked on. Your only instruction from the outgoing engineer was _"a batch job failed on this box last night, can you figure out which one and why?"_ — and that's it. No runbook, no dashboard access. All you have is a shell and the docker CLI.

Your job: enumerate everything Docker knows about on this host, find the container that represents the failed job, and read its logs to surface the error message.

Initial setup

Five containers exist on the host — three are running (a web server, a database, a cache), one is a successfully-completed batch job that exited cleanly last week, and one is a batch job from last night that failed. By default, docker ps will only show you the three running ones. You need a flag to see the rest.

Example interaction

$ docker ps
CONTAINER ID   IMAGE             STATUS         NAMES
a1b2c3d4e5f6   nginx:alpine      Up 2 hours     web-server
b2c3d4e5f6a1   postgres:15       Up 1 day       db-postgres
c3d4e5f6a1b2   redis:7-alpine    Up 3 days      cache-redis

Only three containers? The outgoing engineer said a job failed — nothing here looks failed. That's because docker ps without a flag hides anything that isn't currently running.

Acceptance

You've solved it when:

• You've listed all 5 containers on the host, including stopped ones.
• You've identified the one that exited with a non-zero status (the failed batch job).
• You've read that container's logs so you know what error it printed on the way out.

Constraints

• Tools: docker CLI only.
• Time limit: 5 minutes.
• You don't need to fix anything — just enumerate, identify, and observe. This is a read-only investigation.

Follow-up

1. docker ps -a shows you every container, but on a busy host that can be 100+ rows. What filter flags would narrow it down to just exited non-zero or just the last hour?
2. docker logs without flags streams the entire log. How would you read only the last 20 lines or only lines from the last 5 minutes?