A container can be running or stopped while its filesystem and metadata remain available. Stop asks its process to finish; removal deletes the container object. Retain it while someone still needs logs or an inspection record. Use logs for the main application output and exec for an additional command inside a running container. An exec command writes to the container filesystem, unless a mount maps the path elsewhere. It doesn't change the same path on your host. Here you retain diagnostic evidence, clean up one retired process and leave an unrelated service available throughout the handoff.