Answers: <p>First, see Docker daemon’s log. Refer docker <a href="https://docs.docker.com/config/daemon/" rel="nofollow noreferrer">docs</a></p>
  
  <p>If some request or command executed to the Wordpress container, it might had restarted through docker daemon.</p>
  
Answers: CC BY-SA 4.0
Answers: 2019-06-13T21:04:44.360Z
Answers: Question updated with logs
Answers: Alireza
Answers: CC BY-SA 4.0
Answers: 2019-06-13T19:02:35.497Z
Answers: 2019-06-13T19:02:35.497Z
Answers: Chachatonel Hashimotto
Answers: <p>Docker won't recreate the container itself without something like swarm mode enabled. Since you aren't doing this, an external tool is recreating the container through the docker API. This may be something like a <code>docker-compose</code> command, someone running a <code>docker</code> command directly or via a script, or some other orchestration tool. You can check <code>docker events</code> to get an idea of what API calls were made, but you'll need to look outside of docker and figure out where these commands are coming from.</p>
  
Answers: CC BY-SA 4.0
Answers: 2019-06-17T00:39:55.497Z
Answers: 2019-06-17T00:39:55.497Z
Answers: BMitch
Body: <p>I'm testing Wordpress docker on an Amazon EC2 machine.
  yesterday, all file based changes (like plugins, themes, etc) were gone. The Ec2 machine is up for 8 days, other containers are also up for 8 days, but the Wordpress container is like created 20 hours ago.</p>
  
  <p>I'm not asking about volume mapping etc, I know that to really persist file changes in a container we should use volumes, my question is:</p>
  
  <ol>
  <li>1-On what events the container is re-created? We've not used <code>docker run</code> when it's bee re-created</li>
  <li>How can we see a log of all the events happening on the docker (and not in specific containers)? </li>
  </ol>
  
  <p>EDIT:
  Log from <code>journalctl -u docker.service</code>:</p>
  
  <pre><code>Jun 11 16:05:44 ip-172-31-39-113 dockerd[906]: time="2019-06-11T16:05:44.328303723Z" level=info msg="ignoring event" module=libcontainerd namespace=moby topic=/tasks/delete
  Jun 13 04:05:30 ip-172-31-39-113 dockerd[906]: time="2019-06-13T04:05:30.306067658Z" level=info msg="ignoring event" module=libcontainerd namespace=moby topic=/tasks/delete
  Jun 13 13:40:31 ip-172-31-39-113 systemd[1]: Stopping Docker Application Container Engine...
  Jun 13 13:40:31 ip-172-31-39-113 dockerd[906]: time="2019-06-13T13:40:31.557328738Z" level=info msg="Processing signal 'terminated'"
  </code></pre>
  
  <p>Only the second line is almost at the time container has been deleted and re-created</p>
  
  <p>EDIT2:
  output from <code>docker ps -a</code>:</p>
  
  <pre><code>CONTAINER ID        IMAGE                              COMMAND                  CREATED             STATUS                    PORTS               NAMES
  3aebfdef77c8        wordpress:latest                   "docker-entrypoint.s…"   24 hours ago        Exited (0) 15 hours ago                       site-wordpress
  </code></pre>
  
Comments: CC BY-SA 4.0
Comments: 2019-06-13T22:52:47.083Z
Comments: How did you deploy this container? Is swarm mode, kubernetes, or ECS used? If you can show the `docker ps -a` output of any stopped and recreated container that may also help.
Comments: BMitch
Comments: CC BY-SA 4.0
Comments: 2019-06-14T04:24:19.043Z
Comments: @BMitch Question updated. This is the default mode of docker, I guess none of these.
Comments: Alireza
Comments: CC BY-SA 4.0
Comments: 2019-06-18T19:27:21.433Z
Comments: Please provide the command you used to initialize/launch the container (docker run ... or docker-compose file). The log shows it was "Exited" which indicates possibly your initialization of the container was for a single command usage and not 'persistent' usage or some application/person commanded the exit.
Comments: Steven K7FAQ
Tags: <docker><containers>
Title: Why is docker container recreated
UserDisplayName: Alireza
ThreadText: # Why is docker container recreated
  
  (Asked by: username_0 on 2019-06-13)
  
  I'm testing Wordpress docker on an Amazon EC2 machine.
  yesterday, all file based changes (like plugins, themes, etc) were gone. The Ec2 machine is up for 8 days, other containers are also up for 8 days, but the Wordpress container is like created 20 hours ago.
  
  I'm not asking about volume mapping etc, I know that to really persist file changes in a container we should use volumes, my question is:
  
  1. 1-On what events the container is re-created? We've not used `docker run` when it's bee re-created
  2. How can we see a log of all the events happening on the docker (and not in specific containers)?
  
  EDIT:
  Log from `journalctl -u docker.service`:
  
  ```
  Jun 11 16:05:44 ip-172-31-39-113 dockerd[906]: time="2019-06-11T16:05:44.328303723Z" level=info msg="ignoring event" module=libcontainerd namespace=moby topic=/tasks/delete
  Jun 13 04:05:30 ip-172-31-39-113 dockerd[906]: time="2019-06-13T04:05:30.306067658Z" level=info msg="ignoring event" module=libcontainerd namespace=moby topic=/tasks/delete
  Jun 13 13:40:31 ip-172-31-39-113 systemd[1]: Stopping Docker Application Container Engine...
  Jun 13 13:40:31 ip-172-31-39-113 dockerd[906]: time="2019-06-13T13:40:31.557328738Z" level=info msg="Processing signal 'terminated'"
  
  ```
  
  Only the second line is almost at the time container has been deleted and re-created
  
  EDIT2:
  output from `docker ps -a`:
  
  ```
  CONTAINER ID        IMAGE                              COMMAND                  CREATED             STATUS                    PORTS               NAMES
  3aebfdef77c8        wordpress:latest                   "docker-entrypoint.s…"   24 hours ago        Exited (0) 15 hours ago                       site-wordpress
  
  ```
  
  **Tags:** docker, containers
  
  > **Comments:**
  > **username_1**: How did you deploy this container? Is swarm mode, kubernetes, or ECS used? If you can show the `docker ps -a` output of any stopped and recreated container that may also help.  
  > **username_0**: @username_1 Question updated. This is the default mode of docker, I guess none of these.  
  > **username_2**: Please provide the command you used to initialize/launch the container (docker run ... or docker-compose file). The log shows it was "Exited" which indicates possibly your initialization of the container was for a single command usage and not 'persistent' usage or some application/person commanded the exit.  
  
  ---
  
  ## 2 answers
  
  ### Answer by username_3 on 2019-06-13. Score: 1
  
  First, see Docker daemon’s log. Refer docker [docs](https://docs.docker.com/config/daemon/)
  
  If some request or command executed to the Wordpress container, it might had restarted through docker daemon.
  
  > **Comments:**
  > **username_0**: Question updated with logs  
  
  ---
  
  ### Answer by username_1 on 2019-06-17. Score: 1
  
  Docker won't recreate the container itself without something like swarm mode enabled. Since you aren't doing this, an external tool is recreating the container through the docker API. This may be something like a `docker-compose` command, someone running a `docker` command directly or via a script, or some other orchestration tool. You can check `docker events` to get an idea of what API calls were made, but you'll need to look outside of docker and figure out where these commands are coming from.
  
  
  ---
  
  