Recommended Free Tools
Docker disk use, resource spikes, and container security are easier to manage when you address their causes separately: measure storage before deleting it, set workload limits deliberately, and reduce both container privileges and access to the daemon. These 12 tips apply to Docker Engine on Linux; storage behavior and enforcement can vary by Engine version, kernel, cgroup configuration, and daemon settings.
How do you find and safely reclaim Docker disk space?
Docker’s reported image and container sizes are useful clues, not a complete accounting of the host. Image layers can be shared across containers, so adding their virtual sizes can overstate usage. Container size reporting also excludes logging-driver files and data in volumes or bind mounts. See Docker’s storage overview before treating a reported total as the space Docker can reclaim.
As an Amazon Associate I earn from qualifying purchases.
1. Measure before you prune
Start with Docker’s own disk-usage report, such as docker system df, and identify which object types appear reclaimable. Then account for what that view does not capture: logs, mounted volumes, bind-mounted host directories, and shared image layers. If the host filesystem is nearly full but Docker’s report does not explain why, inspect the host’s disk usage as well rather than assuming an image cleanup will solve it.
2. Choose a prune command by what you are willing to remove
Pruning is an explicit deletion operation. Use the narrowest command that meets the goal, and check what must remain available locally before removing images. Docker documents the scope of pruning unused objects and the system-prune command.
#1 Best Overall
- Get NVMe solid state performance with up to 1050MB/s read and 1000MB/s write speeds in a portable, high-capacity drive(1) (Based on internal testing; performance may be lower depending on host device & other factors. 1MB=1,000,000 bytes.)
- Up to 3-meter drop protection and IP65 water and dust resistance mean this tough drive can take a beating(3) (Previously rated for 2-meter drop protection and IP55 rating. Now qualified for the higher, stated specs.)
- Use the handy carabiner loop to secure it to your belt loop or backpack for extra peace of mind.
- Help keep private content private with the included password protection featuring 256‐bit AES hardware encryption.(3)
- Easily manage files and automatically free up space with the SanDisk Memory Zone app.(5). Non-Operating Temperature -20°C to 85°C
| Command | What it removes | Practical trade-off |
|---|---|---|
docker system prune |
Stopped containers, unused networks, dangling images, and unused build cache | Broader than cleaning one object type; deleted objects are not restored by the command. |
docker system prune -a |
The system-prune items, plus all unused images, including tagged images | Can remove images you intended to keep cached locally; review your needs before running it. |
| Object-specific prune commands | The selected object type rather than the full system-prune scope | Narrower scope can make the deletion easier to assess, but the selected objects are still deleted. |
Do not assume an image is expendable just because no current container uses it: you may want it available for an offline restart or deployment.
3. Treat volumes as application data
A volume can contain persistent databases, uploads, or other state; “unused” does not necessarily mean unimportant. docker system prune leaves volumes alone by default. Adding --volumes includes unused anonymous volumes. Separately, docker volume prune removes unused anonymous volumes by default, while docker volume prune --all also includes unused named volumes. Confirm what a volume contains, and verify backups and retention requirements before deleting it. See Docker’s volume-prune reference.
4. Put a bound on container log growth
The default json-file logging driver does not rotate logs unless you configure rotation, so logs can grow until they consume substantial host storage. Docker’s documented configuration example uses max-size and max-file:
Rank #2
- Capacity Display Variance: 1TB external ssd often appears as around 931GB on Windows. MacOS can show full 1 TB capacity. This is binary calculation difference and doesn’t affect SSD hard drive actual physical storage
- 1050 MB/s Speed: Instantly access to your files with blazing-fast 10Gbps external SSD read up to 1050MB/s and write up to 1000MB/s. LED Light indicates USB SSD instant activity
- Data Security: Solid state drives S.M.A.R.T. health diagnostics and adaptive TRIM optimizing data block management ensures consistent write speeds and extends the longevity of the portable SSD
- USB-C & USB-A Cable: Both cables featuring rapid USB 3.2 Gen2, this USB SSD effortlessly bridges devices, enabling seamless cross-platform file transfers and backup between computers, smartphones, tablets and iPhone
- Always Fast: No slowdowns for large file transfers. With SLC caching (25% of current available capacity allocated as high-speed cache), this external SSD delivers steady 10Gbps for transfers within the cache capacity
{
"log-driver": "json-file",
"log-opts": {
"max-size": "10m",
"max-file": "3"
}
}The 10m size and three-file count are Docker examples, not universal recommendations; choose values that fit the application’s log volume and retention needs. Daemon logging changes apply to newly created containers, not automatically to existing ones, so recreate containers for them to adopt new settings. Check Docker’s logging configuration and JSON File driver options. The local logging driver has rotation defaults and is another option if its behavior suits your operations.
How do you keep a container from monopolizing host resources?
Docker containers have no resource constraints by default. Set limits according to measured workload demand, then monitor how the application behaves under load; a limit that is too low can cause failures rather than simply improving sharing. Docker’s resource-constraints guide also notes that kernel support affects which limits are available.
5. Set a memory limit for workloads that need a boundary
Use Docker’s memory constraint for a workload that should not consume host memory unchecked. Choose the value from the application’s actual working-set needs and test its behavior near that boundary. Watch for out-of-memory behavior after deployment; a memory limit is not a substitute for sizing the workload. Swap-limit support may be unavailable on a particular kernel, and Docker can report that limitation.
Rank #3
- MADE FOR THE MAKERS: Create; Explore; Store; The T7 Portable SSD delivers fast speeds and durable features to back up any endeavor; Build your video editing empire, file your photographs or back up your blogs all in an instant
- SHARE IDEAS IN A FLASH: Don’t waste a second waiting and spend more time doing; The T7 is embedded with PCIe NVMe technology that brings fast read and write speeds up to 1,050/1,000 MB/s¹, making it almost twice as fast as the T5
- ALWAYS MAKE THE SAVE: Compact design with massive capacity; With capacities up to 4TB, save exactly what you need to your drive – from large working files to game data and everything in between
- ADAPTS TO EVERY NEED: Whether using a PC or mobile phone, count on the T7 for extensive compatibility²; It’s a true team player when it comes to heavy-duty application usage or file-saving
- HI RESOLUTION VIDEO RECORDING: Record Ultra High Resolution (4K 60fs) videos directly onto the T7 Portable SSD with your favorite camera or mobile devices; Supports iPhone 15 Pro Res 4K at 60fps video and more³
6. Use CPU limits to make sharing more predictable
Docker’s --cpus option constrains CPU use. Apply it when a runaway or bursty task should not crowd out neighboring work, and select the limit based on measured demand and service requirements. There is no generally safe CPU number for all containers: an undersized limit can increase latency or slow jobs, while an oversized one may not meaningfully protect other workloads.
Free tools Windows power users keep installed
One-click scans. No signup required.
7. Account for disk I/O and temporary files
CPU and memory are not the only resources that affect neighboring workloads. Cgroups can account for and limit disk I/O where the host configuration supports it. For temporary Linux-only data that does not need to persist, a tmpfs mount can avoid writing that data to the container layer. Its contents are ephemeral, and the memory it uses is charged against the container’s memory limit; do not use it for data that must survive a container stop or host reboot. See Docker’s tmpfs documentation and security overview.
How can you reduce container and host risk?
No single container setting makes a compromised container harmless. Reduce the privileges available to the application, limit its access to host resources, and control who can operate the Docker daemon. Docker describes security as a combination of mechanisms, including namespaces, cgroups, capabilities, and host policy, in its Engine security documentation.
Rank #4
- Capacity Display Variance: 250GB external ssd often appears as around 232GB on Windows. MacOS can show full 250 GB capacity. This is binary calculation difference and doesn’t affect SSD hard drive actual physical storage
- 1050 MB/s Speed: Instantly access to your files with blazing-fast 10Gbps external SSD read up to 1050MB/s and write up to 1000MB/s. LED Light indicates USB SSD instant activity
- Data Security: Solid state drives S.M.A.R.T. health diagnostics and adaptive TRIM optimizing data block management ensures consistent write speeds and extends the longevity of the portable SSD
- USB-C & USB-A Cable: Both cables featuring rapid USB 3.2 Gen2, this USB SSD effortlessly bridges devices, enabling seamless cross-platform file transfers and backup between computers, smartphones, tablets and iPhone
- Always Fast: No slowdowns for large file transfers. With SLC caching (25% of current available capacity allocated as high-speed cache), this external SSD delivers steady 10Gbps for transfers within the cache capacity
8. Run the application as a non-root user when practical
Configure the application process to run under a non-root user inside the container, for example with a USER instruction in its Dockerfile. Check that the process can still read required files and write only to intended locations; file ownership and mounted data can otherwise prevent startup or normal operation. This reduces the process’s in-container privilege, but it is one layer of protection rather than a guarantee against host impact.
9. Drop capabilities the application does not need
Docker starts containers with a restricted set of Linux capabilities, but an application may not need all of the capabilities it receives. Docker recommends removing capabilities except those explicitly required. In a container configuration, --cap-drop=ALL is a starting point to evaluate; add a narrowly scoped capability only when the application has a documented need for it. Avoid using --privileged as a shortcut, since it grants far broader access than a targeted capability.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 1110. Consider rootless mode when the workload and host support it
Rootless mode runs both the Docker daemon and containers as a non-root user inside a user namespace. That changes the daemon’s privilege model and can reduce the potential impact of a daemon or runtime vulnerability. It has prerequisites and compatibility limits, however. In particular, resource-control flags depend on cgroup v2, systemd, and available controller delegation; a requested control may be ignored when the required support is absent. Check the host’s configuration and Docker’s rootless-mode guide and rootless tips.
Best Value
- Capacity Display Variance: 500GB external ssd often appears as around 465GB on Windows. MacOS can show full 500 GB capacity. This is binary calculation difference and doesn’t affect SSD hard drive actual physical storage
- 1050 MB/s Speed: Instantly access to your files with blazing-fast 10Gbps external SSD read up to 1050MB/s and write up to 1000MB/s. LED Light indicates USB SSD instant activity
- Data Security: Solid state drives S.M.A.R.T. health diagnostics and adaptive TRIM optimizing data block management ensures consistent write speeds and extends the longevity of the portable SSD
- USB-C & USB-A Cable: Both cables featuring rapid USB 3.2 Gen2, this USB SSD effortlessly bridges devices, enabling seamless cross-platform file transfers and backup between computers, smartphones, tablets and iPhone
- Always Fast: No slowdowns for large file transfers. With SLC caching (25% of current available capacity allocated as high-speed cache), this external SSD delivers steady 10Gbps for transfers within the cache capacity
11. Use user namespace remapping when rootful Docker is required
User namespace remapping maps container UID and GID values to a less-privileged range on the host. It can be useful when you need a rootful daemon but want container identities to map differently on the host. It has compatibility costs: Docker documents limitations involving shared host PID or network namespaces and ordinary use of --privileged. Bind-mounted data may also need host ownership arranged for the mapped IDs. Review the user namespace remapping guide before enabling it.
| Approach | Privilege model | Compatibility considerations |
|---|---|---|
| Rootless mode | Daemon and containers run as a non-root user in a user namespace. | Requires compatible host support; resource controls depend on cgroup v2, systemd, and controller availability. |
| User namespace remapping | Rootful daemon; container UID/GID values map to a less-privileged host range. | Can conflict with shared host PID or network namespaces and ordinary --privileged use; bind-mounted ownership may need adjustment. |
These approaches address different deployment constraints; choose based on daemon requirements, workload compatibility, and host configuration rather than treating them as interchangeable switches.
12. Restrict access to the Docker daemon
On a rootful Docker installation, Docker warns that “The docker group grants root-level privileges to the user.” Only trusted users should receive access to that group or otherwise be allowed to control the daemon. Rootless Docker is a separate option when its prerequisites and application requirements fit. See Docker’s Linux post-installation steps.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Why can Docker disk use differ between installations?
Docker Engine 29.0 and later uses the containerd image store by default on fresh installations. An upgraded installation may still use a classic storage driver, so do not assume every host uses the same storage paths or that legacy overlay2-specific instructions apply. Docker explains the options in its storage-driver selection guide and daemon configuration overview. Check the installed Engine version and configured storage setup before diagnosing paths or changing daemon settings.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
