signadot logs

Note

Sandbox log support requires v1.8.0+ of the Signadot CLI. The --job usage works with earlier versions.

signadot logs shows logs from the CLI, kubectl logs-style. One command covers two log sources:

• Sandbox — a forked workload or a resource in a sandbox (--sandbox).
• Job — a job attempt (--job).

--job and --sandbox are mutually exclusive — pick one source.

Sandbox logs

signadot logs --sandbox <sandbox> --workload <workload> [flags]
signadot logs --sandbox <sandbox> --resource <resource> [--step <step>] [flags]

You reference things by the names in your sandbox spec — no Kubernetes knowledge needed. The server resolves the workload or resource to the running pod(s).

Selecting a source

Flag	Description
--sandbox <name>	Sandbox to read logs from. Required for sandbox logs.
--workload <name>	A sandboxed workload (fork) from your spec. Mutually exclusive with --resource.
--resource <name>	A sandbox resource from your spec. Mutually exclusive with --workload.
--step <name>	Which resource-plugin step to read (only valid with --resource). Defaults to all create steps.

Note

Logs are served for forked workloads. A workload that resolves to a virtual (shared baseline) or local (running on your machine) source returns a clear message rather than unrelated or empty output.

Filtering and output

Flag	Description
-c, --container <name>	Show a single container. Defaults to all; each line is prefixed [<container>] when there is more than one.
--since <duration>	Only logs newer than a relative duration, e.g. 10m, 1h, 2h30m.
--since-time <rfc3339>	Only logs after an absolute timestamp, e.g. 2026-06-30T14:00:00Z. Mutually exclusive with --since.
-f, --follow	Stream new logs as they arrive (like tail -f). Stop with Ctrl-C. Streams plain lines only — not combinable with -o.
-o json|yaml	Structured output instead of plain lines.

Examples

# All containers of a fork
signadot logs --sandbox payments-pr-42 --workload frontend

# One container, last 10 minutes
signadot logs --sandbox payments-pr-42 --workload frontend -c app --since 10m

# Follow (live tail)
signadot logs --sandbox payments-pr-42 --workload frontend -f

# Structured output
signadot logs --sandbox payments-pr-42 --workload frontend -o json

# Resource logs — all steps, then a single step
signadot logs --sandbox payments-pr-42 --resource postgres
signadot logs --sandbox payments-pr-42 --resource postgres --step provision

Discovering names

If you aren't sure of a workload or container name, run without it: the error lists the loggable workloads, and multi-container output is prefixed with each container's name so you can narrow with -c.

Job logs

signadot logs --job <job> [--stream stdout|stderr] [--tail <n>]

Flag	Description
-j, --job <name>	Job whose attempt logs to show.
-s, --stream stdout|stderr	Which stream to show. Job-only.
-t, --tail <n>	Last N lines (0 = all). Job-only.

# stdout of a job
signadot logs --job my-job-[generated_id]

# stderr of a job
signadot logs --job my-job-[generated_id] --stream stderr

Cluster log access

Reading pod logs requires the cluster's operator to grant the Signadot agent pods/log. It is granted by default, but from Operator v1.4.0 a cluster can be installed with controlPlane.podLogAccess.enabled: false to withhold it — in which case sandbox and resource log requests return a 403 naming the cluster and the setting, from both this command and the Signadot Dashboard. Job logs are unaffected, and logs remain available through kubectl and your own logging pipeline.

See Withholding pod log access for how to turn it off, and what else it does and does not affect.

Notes

• The stdout/stderr split (--stream) applies to jobs only; sandbox/pod logs are a single combined stream (a Kubernetes limitation).
• Flags for one source are rejected on the other rather than silently ignored — --stream and --tail require --job; --workload, --resource, --step, --container, --since, and --since-time require --sandbox.