Logs & exec
Stream logs and run interactive commands inside live services. Your two best debugging tools.
Both logs and exec work uniformly across container and process services.
Tailing logs
# Follow live logs (newest first)
rune logs api --follow
# Last 100 lines, then exit
rune logs api --tail=100
# Last 10 minutes
rune logs api --since=10m
# Window: from 10m ago up to 5m ago
rune logs api --since=10m --until=5m
# Filter
rune logs api --grep=errorBy default rune logs <name> aggregates across all instances of the service. To pin a single instance:
rune logs api-instance-7c2e8a3b
# or with explicit type:
rune logs instance/api-instance-7c2e8a3bUseful flags
| Flag | Purpose |
|---|---|
--follow | Stream as logs arrive. |
--tail=N | Start with the last N lines. |
--since=DUR | Only logs after now - DUR. |
--until=DUR | Only logs before now - DUR. |
--grep=PAT | Server-side filter. Faster than piping through grep. |
--timestamps | Include timestamps in the stream. |
-o json | Structured logs (line-delimited JSON). |
Persistence
Today, runed streams logs straight from the runner — no log retention beyond what the container/process itself keeps. For longer retention, ship logs to RuneSight or a third-party log store (RUNE-074, roadmap).
Exec
Run a command inside a running instance:
# Interactive shell
rune exec api
# One-off command
rune exec api -- ls -la /app
# Inspect a specific instance
rune exec api-instance-7c2e8a3b ps aux
# With env and workdir
rune exec --workdir=/app --env=DEBUG=true api python debug.py
# Non-interactive (no TTY)
rune exec --no-tty api python script.py
# Bound timeout
rune exec --timeout=30s api python long-running.pyIf you pass a service name, Rune picks any healthy instance for you. Pass an instance ID to be specific.
When exec hangs
- The container has no TTY-capable shell — try
shinstead ofbash, or--no-tty. - Your terminal isn't forwarding signals — run with
--timeoutto bound it. - The instance is
Unhealthy—rune health instance <id> --checkswill tell you why.
Common debugging recipes
"My service is failing — why?"
rune get service api
rune get instances
rune get instance <failing-id> -o yaml | grep -i message
rune logs <failing-id> --tail=200"Did my config update land?"
rune exec api cat /etc/config/log-level
rune exec api env | grep LOG"Is the database reachable from the api?"
rune exec api
# inside:
nc -zv postgres 5432
curl -sv http://postgres:5432"Where are my mounted secrets?"
rune exec api ls /etc/secrets/db
rune exec api cat /etc/secrets/db/usernameSecurity note
rune exec is gated by the exec verb on service (or instance). Restrict it in policies for non-on-call users — it's effectively root inside the container.