Playbook

Disk Full Incident

Follow a safe cleanup order and prevent recurrence with rotation.

Clear large log files first (app, nginx, system logs).

Remove temp files and orphaned artifacts.

Prune containers/images if safe to do so.

Find largest directories under /var/log and /tmp.

Check for runaway debug logs or trace files.

Rotate or compress oversized files.

Enable logrotate with size + time thresholds.

Set retention policies for backups and artifacts.

Add disk usage alerts before hitting 80/90%.

Largest directories

du -h /var/log /tmp --max-depth=1 | sort -hr | head -n 10

Largest files

find /var/log -type f -size +100M -print0 | xargs -0 ls -lh

Docker cleanup

docker system df

docker system prune -f