Why is docker container recreated

Question

I'm testing Wordpress docker on an Amazon EC2 machine. yesterday, all file based changes (like plugins, themes, etc) were gone. The Ec2 machine is up for 8 days, other containers are also up for 8 days, but the Wordpress container is like created 20 hours ago.

I'm not asking about volume mapping etc, I know that to really persist file changes in a container we should use volumes, my question is:

1. 1-On what events the container is re-created? We've not used docker run when it's bee re-created
2. How can we see a log of all the events happening on the docker (and not in specific containers)?

EDIT: Log from journalctl -u docker.service:

Jun 11 16:05:44 ip-172-31-39-113 dockerd[906]: time="2019-06-11T16:05:44.328303723Z" level=info msg="ignoring event" module=libcontainerd namespace=moby topic=/tasks/delete
Jun 13 04:05:30 ip-172-31-39-113 dockerd[906]: time="2019-06-13T04:05:30.306067658Z" level=info msg="ignoring event" module=libcontainerd namespace=moby topic=/tasks/delete
Jun 13 13:40:31 ip-172-31-39-113 systemd[1]: Stopping Docker Application Container Engine...
Jun 13 13:40:31 ip-172-31-39-113 dockerd[906]: time="2019-06-13T13:40:31.557328738Z" level=info msg="Processing signal 'terminated'"

Only the second line is almost at the time container has been deleted and re-created

EDIT2: output from docker ps -a:

CONTAINER ID        IMAGE                              COMMAND                  CREATED             STATUS                    PORTS               NAMES
3aebfdef77c8        wordpress:latest                   "docker-entrypoint.s…"   24 hours ago        Exited (0) 15 hours ago                       site-wordpress

Answer 1

First, see Docker daemon’s log. Refer docker docs

If some request or command executed to the Wordpress container, it might had restarted through docker daemon.

Answer 2

Docker won't recreate the container itself without something like swarm mode enabled. Since you aren't doing this, an external tool is recreating the container through the docker API. This may be something like a docker-compose command, someone running a docker command directly or via a script, or some other orchestration tool. You can check docker events to get an idea of what API calls were made, but you'll need to look outside of docker and figure out where these commands are coming from.