The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
To manage Docker safely on Linux, measure what is using disk space before pruning, set resource limits for workloads that need them, and reduce unnecessary container and daemon privileges. The 12 tips below cover those jobs without treating cleanup as risk-free or any one security setting as a complete isolation boundary.
Docker Engine version, kernel support, cgroup mode, and daemon configuration affect some of these controls. Docker Engine 29.0 and later uses the containerd image store by default on fresh installations; upgraded systems may still use classic storage drivers, so do not assume every installation uses the same storage paths.
Find and reclaim Docker disk space safely
1. Measure more than image size
Start with Docker’s size reporting, such as docker system df, as a clue rather than a complete accounting of host storage. Image layers can be shared across containers, so adding reported virtual sizes can overcount. Container size reporting also omits logging-driver files and data stored in volumes or bind mounts. See Docker’s storage overview for how layers and storage are accounted for.
For a fuller picture, account separately for Docker-managed images and containers, logs, volumes, and host directories used as bind mounts. On Engine 29.0 and later fresh installations, the containerd image store is the default; upgraded installations may retain a classic driver, so storage locations can differ. The storage driver selection guide provides context on driver choices.
#1 Best Overall
- 12th Intel Alder Lake N95 Processor – The GMKtec G3 S Mini PC is powered by the 12th Gen Intel N95 processor with 4 cores, 4 threads, 6MB cache and a burst frequency up to 3.4GHz. Compared with N100/N5105/N5100/N5095, the N95 delivers up to 36% overall performance improvement. Perfect for routine tasks, office work, and home entertainment, this compact mini desktop is more convenient than traditional bulky PCs.
- 8GB RAM & 256GB SSD Storage – Pre-installed with 8GB DDR4 memory and a fast 256GB M.2 2242 SSD, the G3 S mini desktop offers quicker startup, smoother multitasking, and faster file transfers. Enjoy seamless performance whether you’re working on multiple applications, browsing, or streaming content.
- Rich Interfaces & Connectivity – The G3 S mini computer comes equipped with USB 3.2 (up to 10Gbps), dual HDMI 2.0 (4K@60Hz), and a 3.5mm audio jack. With support for WiFi 5, Bluetooth 5.0, and Gigabit Ethernet (RJ45 1000MbE), it connects easily with monitors, projectors, printers, office equipment, and other peripherals, making it versatile for both home and business use.
- Dual 4K Display Support – Featuring upgraded Intel UHD Graphics (up to 1000MHz), the G3 S supports 4K video playback and AV1 decoding for a smooth viewing experience. With dual HDMI outputs, you can connect two 4K@60Hz displays simultaneously, enabling efficient multitasking for work and entertainment.
- GMKTEC WARRANTY - GMKtec offers a 3-year limited warranty (1 year replacement + 2 years parts replacement) for each mini PC, starting from the date of the purchase effective on all sales starting Oct. 2026. All defects due to design and workmanship are covered. With a professional after sales team always ready to attend to your needs, you can simply relax and enjoy your mini PC
2. Prune only the objects you intend to remove
docker system prune removes stopped containers, unused networks, dangling images, and unused build cache. It does not remove every unused image. Adding -a expands the scope to all unused images, including tagged images, which may need to be downloaded again later.
Choose cleanup scope deliberately: use an object-specific prune command when you want to target one category, or use system prune when its combined scope is acceptable. Pruning deletes objects, so check that needed images and stopped containers can be recreated or fetched before proceeding. Docker documents the scope in its pruning guide and the system prune reference.
3. Treat volumes as application data
Volumes can contain persistent application data. A volume being unused by a running container does not mean its contents are disposable. By default, docker system prune leaves volumes alone; adding --volumes includes unused anonymous volumes.
Recommended Free Tools
docker volume prune removes unused anonymous volumes by default. Adding --all includes unused named volumes as well. Before deleting volumes, confirm that their data is backed up or no longer needed. See the pruning guide and volume prune reference.
4. Bound container log growth
The default json-file logging driver does not rotate logs unless you configure it. One documented example sets a maximum size of 10m and keeps 3 files. These are configuration examples, not universal sizing recommendations; choose values that suit your workload and available disk.
To apply rotation defaults through daemon configuration, add an equivalent configuration to /etc/docker/daemon.json and restart the daemon. For example:
Rank #2
- High-Performance NAS with Powerful Procesor: Intel Core 5 320 is ideal for small offices, & More. You can enjoy smooth performance and seamless collaboration, while making use of advanced features like Docker and virtual machines. It works semalessly across every device inluding Windows, macOS, Linux, iOS, Android or Google services and so on.
- Better Way to Store Than External Drives: NAS offers centralized storage, automatic backups, remote access, and a wide range of RAID options for easy data recovery even if a drive fails. Massive Storage Capacity: Never worry about storage limits again. With up 144TB capacity, you can store 50 million 1MB photos or 98K 1.5GB movies，5 million 30MB songs! *Hard Drives not included.
- Secure Private Cloud: Retain 100% data ownership with advanced encryption to protect your files. Flexible permission management makes it easy to protect your privacy when collaborating with others.
- AI-Powered Photo Album: Automatically organizes your photos by recognizing faces, scenes, objects, and locations. It can also instantly remove duplicates, freeing up storage space and saving you time.
- User-Friendly App: Simple setup and easy file-sharing on Windows, macOS, Android, iOS, web browsers, and smart TVs, giving you secure access from any device.
{
"log-driver": "json-file",
"log-opts": {
"max-size": "10m",
"max-file": "3"
}
}Daemon logging changes apply to newly created containers; existing containers do not automatically adopt them. Recreate existing containers for the new settings to take effect. Alternatively, Docker’s local driver has rotation defaults. Logging configuration, the JSON file driver, and the local driver documentation explain the options.
| Logging choice | What to know |
|---|---|
json-file with rotation options |
Familiar default driver; configure max-size and max-file to rotate logs. |
local |
Has rotation defaults, reducing the need to configure rotation manually. |
Keep containers from monopolizing host resources
5. Set memory limits based on workload needs
Docker containers have no resource constraints by default. Set a memory limit for workloads that should not be able to consume host memory unchecked, but base it on the application’s working needs rather than copying a generic value. Monitor the workload for out-of-memory behavior after applying the limit. Kernel support matters; Docker may report when swap-limit support is unavailable. See Docker’s resource constraints documentation.
6. Use CPU limits to protect neighboring workloads
The --cpus option constrains CPU use. It can help prevent a runaway or CPU-intensive container from crowding out other tasks, but the appropriate limit depends on measured demand and service requirements. Apply the limit when creating a container, for example:
docker run --cpus="1.5" IMAGEThe value shown is an example, not a recommended setting for every application. Verify that the host’s kernel and cgroup configuration support the constraints you use.
7. Account for disk I/O and temporary files
Cgroups can account for and limit resource use, including disk I/O where the host configuration supports it. Check the capabilities of the host rather than assuming every I/O control is available.
For temporary Linux-only data that should not persist, a tmpfs mount can avoid writes to the container layer. Its contents are ephemeral, and the memory it uses is charged to the container’s memory limit, so it is unsuitable for data that must survive a container stop or host reboot. Docker describes tmpfs mounts and the broader Engine security model.
Rank #3
- Built for Local AI Development: AMD Ryzen AI Halo is designed for local AI development and inference, featuring 128GB unified memory and support for up to 200B parameter models to build and run intensive AI workloads locally.
- 128GB Unified Memory: Features 128GB LPDDR5x unified memory at 8000 MT/s with 256 GB/s memory bandwidth, providing a shared memory pool across the CPU, GPU, and NPU to support larger AI models.
- AMD Ryzen AI Max+ 395 Processor: Features 16 cores, 32 threads, and Zen 5 architecture, paired with AMD Radeon 8060S integrated graphics featuring 40 RDNA 3.5 compute units and an AMD XDNA 2 NPU with up to 50 TOPS.
- Linux AI Developer Platform: Purpose-built for Linux-based AI development with full AMD ROCm software support and preloaded tools, models, and workflows optimized for local AI development.
- Compact, Connected Design: Includes a 2TB M.2 SSD, 10GbE LAN, Wi-Fi 7, Bluetooth 5.4, USB-C connectivity, and HDMI 2.1b.
Reduce container privileges and host exposure
8. Run the application as a non-root user inside the container
When the application supports it, configure the container to run its process as a non-root user. This reduces the privileges of that process inside the container, but it does not make the host invulnerable or replace other controls. Docker’s security guidance recommends non-privileged processes as part of a layered approach.
9. Drop capabilities the application does not need
Docker starts containers with a restricted capability set. Further reduce privileges by dropping capabilities the application does not require, then add back only a capability justified by a specific application need. Avoid using --privileged as a general fix: it grants broad access rather than narrowly resolving a missing permission. Review the Docker Engine security guidance before changing a container’s capability set.
10. Consider rootless mode when its requirements fit
Rootless mode runs both the Docker daemon and containers as a non-root user inside a user namespace. This reduces the potential impact of vulnerabilities in the daemon or runtime, but it has prerequisites and compatibility limits.
Resource-control flags in rootless mode depend on cgroup v2 and systemd support. If required controllers are not available or delegated, some resource limits can be ignored. Check Docker’s rootless mode requirements and rootless tips against the host before relying on a limit.
11. Consider user namespace remapping for rootful Docker
If you need a rootful daemon, user namespace remapping maps container UID and GID values to a less-privileged range on the host. It has compatibility trade-offs: Docker documents incompatibilities with sharing host PID or network namespaces and with ordinary use of --privileged. Bind-mounted files may also need host ownership arranged for the mapped IDs. The user namespace remapping guide covers the setup and limitations.
| Option | Daemon model | Important compatibility consideration |
|---|---|---|
| Rootless mode | Daemon and containers run as a non-root user inside a user namespace. | Resource controls depend on cgroup v2, systemd, and available controller delegation. |
| User namespace remapping | Rootful daemon; container UID/GID values map to a less-privileged host range. | Host PID or network namespace sharing and ordinary --privileged use are incompatible; bind-mounted ownership may need adjustment. |
12. Restrict access to the Docker daemon
On a rootful installation, membership in the docker group grants root-level privileges. Docker states in its Linux post-installation guide that “The docker group grants root-level privileges to the user.” Only trusted users should receive daemon access. Rootless Docker is a separate option where its requirements and compatibility fit.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Free tools Windows power users keep installed
One-click scans. No signup required.
