Halloween DealsAmazon USHalloween week deals: useful picks before month-endAmazon US: current deals, useful picks and tech finds.Check DealsPC HealthRecommendedCrashes, freezes, slowdowns? Check your PC nowSpot repairable issues before they interrupt work.Check PCHalloween DealsAmazon USOctober picks are moving - compare before checkoutAmazon US: current deals, useful picks and tech finds.See Picks×
Skip to content
World desk8 min

Where Docker Images Are Stored After Docker Pull on Ubuntu (and How to Verify the Path)

Docker usually stores pulled image layers under /var/lib/docker/overlay2 on Ubuntu, but Docker Engine 29+ may use containerd under /var/lib/containerd. Learn how to verify and change the active location safely.
Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

On a conventional Docker Engine installation on Ubuntu, docker pull stores image layers under Docker’s local data root, normally /var/lib/docker. When the classic overlay2 driver is active, the layer directories are beneath /var/lib/docker/overlay2.

That default is not universal. The daemon’s data root can be changed, and fresh Docker Engine 29.0-or-later installations use Docker’s containerd image store by default, placing image contents and container snapshots under /var/lib/containerd. The authoritative answer for any host is the Docker Root Dir and Storage Driver shown by docker info.

As an Amazon Associate I earn from qualifying purchases.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Use docker info to find the active location

Filesystem paths vary according to Docker’s storage backend and configuration. Do not infer the location from the Ubuntu version or from a tutorial written for another Docker release. On the host where the pull occurred, run:

docker info

In the output, locate:

  • Docker Root Dir: the daemon’s configured local data directory for the active backend.
  • Storage Driver: the classic filesystem driver, such as overlay2, used by that daemon.

A typical older or explicitly classic installation reports Docker Root Dir: /var/lib/docker and Storage Driver: overlay2. In that case, pulled layers can be inspected beneath /var/lib/docker/overlay2. If the root directory is different, use the reported directory rather than assuming /var/lib/docker.

Most Docker administration commands need root privileges on Ubuntu. If your account is not in Docker’s Unix group, run the diagnostic as sudo docker info.

What the classic /var/lib/docker layout means

Docker’s storage-driver documentation describes a pull as a series of layer downloads: each image layer is fetched separately and stored in Docker’s local storage area. For a classic Linux Engine, that area is usually /var/lib/docker. The image name and tag are metadata; the layer contents are content-addressed files managed by the daemon.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

The overlay2 directory

With overlay2, the relevant top-level directory is:

/var/lib/docker/overlay2

Each subdirectory represents storage used by an image layer or a container’s writable layer. Directory names are implementation identifiers, not friendly image names, so you should not expect a folder called ubuntu after pulling an Ubuntu image.

OverlayFS presents a union of read-only lower layers and one writable upper layer as a merged filesystem. A running container’s storage directory can include:

  • lower-id, which records the lower-layer relationship;
  • merged, the unified view presented to the container;
  • upper, the container’s writable changes; and
  • work, an OverlayFS working directory.

Image layers are shared through copy-on-write. Several images can therefore refer to the same lower layer, and deleting one image does not necessarily reclaim all of the apparent directory size if another image or container still references those layers.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Why the directory can be large

A pull may bring several layers, and a container created from that image can add a writable layer. Updates made inside a container—installed packages, generated files, and deleted-file whiteouts—belong to that writable layer rather than changing the original image. The writable layer is ephemeral: removing the container removes that layer. It is not a suitable place for data that must survive container replacement.

Persistent application data belongs in a Docker volume or a bind mount. Volumes are managed separately from image layers, while a bind mount uses a directory on the host that you choose. Consequently, disk usage attributed to Docker can come from image layers, stopped containers, writable layers, volumes, build cache, or logs; the path alone does not identify which category is responsible.

Docker Engine 29.0 and the containerd image store

Docker’s current storage model introduces an important version distinction. Fresh Docker Engine 29.0 or later installations use the containerd image store by default. With that backend, image contents and container snapshots are held under:

/var/lib/containerd

An installation upgraded from an earlier release, or one configured to retain the classic image store, may continue to report a classic driver such as overlay2 and keep its data under the Docker root directory. Therefore, “Docker images are in /var/lib/docker” is a description of the classic backend, not a guarantee for every current installation.

Free tools Windows power users keep installed

One-click scans. No signup required.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

The containerd backend has its own root setting in /etc/containerd/config.toml. Docker’s data-root setting does not relocate image and container data that is being stored by containerd. Check the active backend first, then change the configuration belonging to that backend.

Classic and containerd locations at a glance

Backend reported by the host Typical data location What to verify
Classic storage driver, such as overlay2 /var/lib/docker, with overlay layers under /var/lib/docker/overlay2 Docker Root Dir, Storage Driver, and any customized data-root
Containerd image store /var/lib/containerd by default Containerd’s configured root in /etc/containerd/config.toml
Any customized classic root The directory shown as Docker Root Dir The daemon configuration and filesystem permissions

The table shows defaults, not a substitute for inspecting the machine. A non-default mount, package configuration, or administrator change can move either data root.

How to change the classic Docker data directory

For the classic Docker image store, Docker documents the data-root setting in /etc/docker/daemon.json. For example:

{"data-root": "/mnt/docker-data"}

Changing this value tells the classic daemon where to keep its Docker-managed data. It does not automatically migrate existing files, and it does not control a containerd image store.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Safe migration outline for a classic installation

  1. Confirm the current backend and root with sudo docker info. Proceed only if the host uses the classic store you intend to move.
  2. Stop Docker so files are not changing during the copy:
    sudo systemctl stop docker
  3. Create the destination on the mounted filesystem, for example:
    sudo mkdir -p /mnt/docker-data
  4. Copy the existing Docker root while preserving ownership, permissions, links, extended attributes, and hard links. An administrator commonly uses:
    sudo rsync -aHAX /var/lib/docker/ /mnt/docker-data/
  5. Edit /etc/docker/daemon.json. If the file already contains settings, add data-root to the existing JSON object instead of replacing unrelated options. The resulting value should point to the destination directory.
  6. Start Docker and verify the result:
    sudo systemctl start docker
    sudo docker info

    Confirm that Docker Root Dir now shows the destination and that existing images and containers are present.

  7. Keep the old directory until verification and a rollback plan are complete. Do not delete it merely because the daemon starts; check the workloads that depend on the stored images and volumes first.

The exact migration command is an administrative choice, but the safety requirements are constant: stop the daemon, preserve metadata, ensure the destination is mounted at boot, and verify with Docker rather than judging by directory names.

Moving data with the containerd backend

If docker info indicates a containerd-backed image store, configure containerd’s own root in /etc/containerd/config.toml. A Docker data-root entry will not move those image contents. Plan the change with both services stopped, preserve the existing containerd data and permissions, then restart containerd and Docker and verify that images and containers are available. The active containerd configuration and service status should be treated as authoritative for that backend.

Tell image layers apart from other Docker disk usage

When /var/lib/docker or /var/lib/containerd consumes substantial space, identify the object before deleting anything. Start with Docker’s accounting command:

docker system df -v

This reports space associated with images, containers, local volumes, and build cache, including reclaimable categories where Docker can calculate them. Useful supporting checks include:

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.
  • docker image ls to list locally tagged images and their displayed sizes;
  • docker ps -a --size to show container writable-layer sizes, including stopped containers; and
  • docker volume ls to inventory named volumes before considering volume cleanup.

A filesystem tool such as du can show which top-level directory is growing, but it cannot safely determine layer ownership by itself. Treat Docker’s metadata as the source of truth.

Supported cleanup choices

Remove objects through Docker rather than deleting files inside its data root:

  • docker image prune removes dangling images after confirmation.
  • docker container prune removes stopped containers after confirmation.
  • docker volume prune removes unused volumes; check application backups first because volume data can be persistent.
  • docker system prune combines several unused-object categories. Adding --volumes expands the operation to unused volumes and therefore requires extra caution.

These commands operate on Docker’s records and references. Never “free space” by removing an arbitrary directory beneath overlay2 or by deleting files from the containerd root.

Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Support on Ko-Fi

Why manually editing overlay2 breaks Docker

Docker explicitly warns not to directly manipulate files or directories within its data directory. Layer IDs, metadata, reference counts, and copy-on-write relationships must remain consistent. Renaming a layer directory, deleting a file that appears unused, or copying only part of the tree can make images unpullable, containers unstartable, or the daemon unable to mount a layer.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Use read-only inspection when diagnosing a problem, and use Docker commands for removal. If a layer directory appears orphaned, gather docker info, docker system df -v, daemon logs, and the affected image or container IDs before taking corrective action.

Uninstalling Docker does not necessarily remove the images

On Ubuntu, removing the Docker Engine package does not automatically prove that Docker-managed data has been erased. Images, containers, volumes, and networks stored in /var/lib/docker can remain after an uninstall. This explains why reinstalling Docker may appear to restore old images or why disk usage persists after package removal.

Before deleting a former data root, verify that no Docker or containerd service still references it and that you have exported any images or backed up any volumes you need. Deleting the directory is a separate, deliberate data-destruction decision—not a routine consequence of uninstalling the package.

Common location questions, answered by diagnosis

“I pulled an image, but I cannot find a folder named after it.”

That is expected. Overlay2 uses internal layer identifiers and shared content rather than one human-readable directory per repository tag. Use docker image ls for image names and docker info for the storage root.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

“Why is /var/lib/docker/overlay2 full when my images look small?”

Displayed image sizes can share layers, while the filesystem also contains container writable layers, build cache, and metadata. Check docker system df -v and container sizes before removing anything.

“I changed data-root, but the disk usage did not move.”

First confirm that Docker actually reports the new root. If the host uses the containerd image store, data-root is the wrong setting for image contents; inspect containerd’s root configuration instead. Also verify that the destination filesystem is mounted and that the daemon restarted successfully.

“Can I open or edit files in the layer directory?”

You may inspect paths read-only for diagnostics, but do not edit, move, or delete Docker-managed layer files. Use Docker’s image, container, volume, and prune commands to make changes.

Practical checklist

  1. Run sudo docker info.
  2. Record Docker Root Dir and Storage Driver.
  3. For classic overlay2, inspect the reported root’s overlay2 subdirectory; for containerd, inspect the configured containerd root.
  4. Use docker system df -v to distinguish images, writable layers, volumes, and cache.
  5. Change data-root only for the classic store; change containerd’s root for the containerd store.
  6. Never delete files inside Docker’s managed storage tree by hand.

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.

What’s actually slowing this PC down?

Pick the symptom - the matching free tool is one click away.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Leave a Reply

Your email address will not be published. Required fields are marked *

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

More from the Wire

  1. World desk4 min
    How to Spot an AI Voice Scam Before Sending MoneyDon’t rely on how a caller sounds. Pause, call back through a known number, and verify the emergency with another trusted person before sending money.
  2. Mountain View desk4 min
    Google’s SynthID Detector: How to Check AI-Generated Images, Video and AudioGoogle’s SynthID Detector looks for an embedded watermark in supported images, video and audio. Here is what its results do—and do not—show.
  3. Redmond desk20 min
    How to create a link to File or Folder in Windows 11Windows 11 gives you several ways to point to a file or folder without moving or duplicating it. You can create a desktop shortcut,…
Recommended PC Tool
Recommended PC Tool
Crashes, No Sound, or Screen Glitches?Free driver scan
PC Slower Than It Used to Be?Free scan - under a minute

Two free Windows tools

One Free Minute Could Fix That PC

Before you go - each of these free tools takes about a minute and tackles what quietly slows a Windows PC down.

Special offer. View Outbyte info, uninstall instructions, EULA, and Privacy Policy.