When a Docker host runs low on disk space, the cause is usually one of five things: container logs, a container's writable layer, volumes, unused images, or build cache. This guide shows how to find which one is responsible and reclaim the space safely. It applies to any Linux host running Docker, including an ICSDC Linux VPS.
Run all commands on the Docker host as root or with sudo. Paths assume the default data directory, /var/lib/docker. To confirm yours, run docker info --format '{{.DockerRootDir}}'.
Step 1: Confirm Docker is using the space
df -hsudo du -xh /var/lib/docker --max-depth=1 | sort -hdf shows which filesystem is full. du ranks Docker's subdirectories (-x stays on one filesystem). Mainly, overlay2 holds image layers and container writable layers, containers holds logs and container configuration, and volumes holds volume data.
If /var/lib/docker is not the largest consumer, the space is used outside Docker, for example in a bind-mounted host directory. Check with sudo du -xh / --max-depth=1 | sort -h.
Step 2: Get Docker's own breakdown
docker system dfdocker system df -vThe first command summarizes Images, Containers, Local Volumes and Build Cache, with total and reclaimable size. The -v flag lists every item. On hosts with many containers it can be resource-intensive, so avoid running it repeatedly at peak load.
- Large reclaimable Images or Build Cache: go to Step 5.
- Large Local Volumes: go to Step 4.
- Small totals here, but a large containers directory in Step 1: suspect logs (Step 3). docker system df does not break out log files.
Step 3: Check container logs
Docker's default json-file logging driver has no size limit unless you set one. Confirm the driver:
docker info --format '{{.LoggingDriver}}'If it returns json-file, list the largest log files:
sudo sh -c 'du -h /var/lib/docker/containers/*/*-json.log | sort -h | tail -5'Match a log path to a container name:
docker inspect --format '{{.Name}} {{.LogPath}}' $(docker ps -aq)A multi-gigabyte log means that container writes heavily to stdout or stderr. Apply the fix in Step 6.
Step 4: Check writable layers and volumes
docker ps -a -sThe first SIZE value is the container's writable layer. The "virtual" value adds the read-only image data. A large writable layer means the application is writing inside the container filesystem, such as temporary files, caches or uploads. To see what changed:
docker diff <container> | head -50docker exec <container> du -xh -d 2 / | sort -h | tailThe second command works only if du and sort exist in the image.
Volume sizes appear under Local Volumes in docker system df -v. To find the container using a volume:
docker ps -a --filter volume=<volume_name>Volumes usually hold data you need, such as databases or uploads. Reduce their size from inside the application instead of deleting the volume.
Step 5: Review images and build cache
In docker system df -v, images used by zero containers are unused. List dangling (untagged) images with docker images -f dangling=true. The Build Cache section lists cache entries that can be pruned in Step 6.
Step 6: Reclaim space safely
Warning: Deletion cannot be undone. Take a backup or snapshot of the server first, and confirm that no data you need lives only in a stopped container or volume.
Stop log growth. Add rotation to /etc/docker/daemon.json, merging with any keys already present:
{ "log-driver": "json-file", "log-opts": { "max-size": "10m", "max-file": "3" }}Restart Docker with sudo systemctl restart docker. This stops running containers unless live-restore is enabled, so schedule it as maintenance. The new setting applies only to containers created afterward. Recreate existing ones (with Compose: docker compose up -d --force-recreate). Recreating a container also removes its old log file.
Remove unused objects:
docker system pruneThis asks for confirmation, then removes stopped containers, unused networks, dangling images and unused build cache. Add -a to remove all unused images, which are pulled again when needed. Volumes are not removed unless you add --volumes; do not add it unless you have verified that no volume holds data you need. To clear only build cache, run docker builder prune.
Step 7: Verify the fix
docker system dfdf -h /var/lib/dockerdocker inspect --format '{{.HostConfig.LogConfig}}' <container>Free space should increase, and the log configuration should show json-file with your max-size and max-file values. If max-size is missing, the container predates the setting and must be recreated.
If df reports far more used space than du accounts for, a deleted file may still be held open by a process. List such files with sudo lsof +L1, then restart the owning service.
For hands-off server administration, see ICSDC Managed VPS Hosting.