Docker Disk Usage Investigation - docker system df / Logs / Volumes

2025-12-15 Reading time: About 10 min Difficulty: Intermediate

What You'll Learn

• How to identify what's consuming disk space in Docker environments
• Use docker system df to determine if images/containers/volumes are the cause
• Safe verification steps before any deletion

1. First: Check If Disk Is Actually Full (df)

Conclusion: Run df -h first — the partition that is full is not always Docker.

Before blaming Docker, verify what's full:

$ df -h

Common Patterns

• / is full (Docker data often lives under root)
• /var is a separate partition that's full (/var/lib/docker effect)

2. Check How Much Docker Is Using

Conclusion: Run docker system df to see which category is largest before investigating.

Get an overview first:

$ docker system df

What to Look For

• Images: Are images piling up?
• Containers: Are stopped containers accumulating?
• Local Volumes: Are volumes growing?
• Build Cache: Is build cache accumulating?

3. Locate What's Growing

Conclusion: Run du -h -d 1 /var/lib/docker — large output confirms Docker is the source.

Docker data typically lives here (may vary by setup):

• Docker data: /var/lib/docker
• Container logs: /var/lib/docker/containers/<container-id>/*.log

Check the size of /var/lib/docker:

$ sudo du -h -d 1 /var/lib/docker | sort -h

4. Check for Container Log Bloat

Conclusion: Large *-json.log files under the containers directory signal log bloat.

Docker stores container stdout/stderr as logs by default. Continuous logging causes growth here.

4-1. Check containers directory size

$ sudo du -h -d 2 /var/lib/docker/containers | sort -h | tail -n 20

4-2. Find large log files (top 20)

$ sudo find /var/lib/docker/containers -type f -name "*.log" -printf "%s %p\n" | sort -n | tail -n 20

5. Identify Which Container Is the Cause

Conclusion: Use docker ps -a or docker inspect to map a container ID to its name.

Map the container ID (long string in path) to container name:

5-1. List containers (ID and name)

$ docker ps -a --format "table {{.ID}}\t{{.Names}}\t{{.Status}}\t{{.Image}}"

5-2. Get details for a specific container ID

$ docker inspect <container-id> --format '{{.Name}}'

Note: .Name may have a leading /.

6. Check Volume Growth

Conclusion: Run docker volume ls to list volumes, then check which container uses each.

DB data, WordPress uploads, caches etc. tend to accumulate in volumes.

6-1. List volumes

$ docker volume ls

6-2. See which container uses which volume

$ docker ps -a --format "table {{.Names}}\t{{.Mounts}}"

7. Safety Precautions (Important)

Conclusion: Never run docker system prune without checking — volumes hold real data.

Mitigation Approaches

If log bloat is the cause, typical next steps include:

• Configure log rotation (Docker logging driver / log-opts with limits)
• Review application log volume (error storms, debug logs)
• Forward necessary logs to a separate system

Verification

Conclusion: Re-run df -h and docker system df to confirm usage has decreased.

After investigation or mitigation, verify improvement:

$ df -h
$ docker system df