03 / FIELD NOTES

The disk is full

Find what takes the space, then clear logs, apt caches, and unused Docker images.

Why this way

On small VPS disks the usual culprits are the systemd journal, Docker images and build cache, and container logs. Measure first so you only remove what is actually large.

When to use

Writes fail with "No space left on device", or df shows the root filesystem near 100%.

When not to

Do not delete files under /var/lib/docker by hand. Use docker commands instead.

Prerequisites

root or sudo

Steps

Which directories are largest

Read-only

df -h /
du -xh / --max-depth=2 2>/dev/null | sort -h | tail -n 15

Expect: The last lines are the largest directories on the root filesystem.

Journal and Docker usage

Read-only

journalctl --disk-usage
docker system df

Expect: Compare these numbers with the du output before cleaning anything.

Shrink the journal and apt cache

Changes config

journalctl --vacuum-size=200M
apt-get clean

Expect: Keeps the newest 200 MB of logs and removes downloaded packages. On Rocky or AlmaLinux use dnf clean all; on Alpine use apk cache clean (Alpine has no journal).

Remove unused Docker data

Changes config

docker image prune -a
docker builder prune

Expect: Both ask before deleting. Images used by any container, running or stopped, are kept.

What it changes

The last two steps delete old logs, package caches, and unused images. Data volumes are not touched.

{
  "slug": "disk-full",
  "risk": "caution",
  "tags": [
    "disk",
    "docker",
    "logs",
    "linux"
  ],
  "updated": "2026-10-30",
  "pathIndex": null,
  "why": "On small VPS disks the usual culprits are the systemd journal, Docker images and build cache, and container logs. Measure first so you only remove what is actually large.",
  "steps": [
    {
      "command": "df -h /\ndu -xh / --max-depth=2 2>/dev/null | sort -h | tail -n 15",
      "risk": "safe"
    },
    {
      "command": "journalctl --disk-usage\ndocker system df",
      "risk": "safe"
    },
    {
      "command": "journalctl --vacuum-size=200M\napt-get clean",
      "risk": "caution"
    },
    {
      "command": "docker image prune -a\ndocker builder prune",
      "risk": "caution"
    }
  ]
}