Which Container Ate All Your Storage?

Luke Hebert

- 2 minutes read - 332 words

docker

Disk space on a Docker host can vanish without a clear explanation. The overlay2 directory holds every container layer as a hashed ID, making it hard to tell which container is eating your storage. This guide walks through a quick pipeline using docker inspect, jq, and xargs to map those cryptic hashes back to the container names you actually recognize.

Whether you are running a Docker daemon on a development host or a GKE worker node using Docker as the container engine, understanding which containers consume the most disk is essential for capacity planning and troubleshooting.

If you navigate into the /var/lib/docker/overlay2 directory, you will see cryptic hashed IDs representing the container layers instead of a human-readable name. The steps below resolve that.

Identify the Largest Overlay Directories

# as root
sudo su

# grab the size and path to the largest overlay dir
du /var/lib/docker/overlay2 -h | sort -h | tail -n 100 | grep -vE "overlay2$" > large-overlay.txt

# make sure json parser is installed
yum install jq -y

# construct mappings of name to hash
docker inspect $(docker ps -qa) | jq -r 'map([.Name, .GraphDriver.Data.MergedDir]) | .[] | "\(.[0])\t\(.[1])"' > docker-mappings.txt

# for each hashed path, find matching container name
cat large-overlay.txt | xargs -l bash -c 'if grep $1 docker-mappings.txt; then echo -n "$0 "; fi'

Map Volumes/Mounts to Containers

# List each container with its mounts (type, source, name, destination)
docker ps -a --format '{{ .ID }}' | xargs -I {} docker inspect -f '{{ .Name }}{{ printf "\n" }}{{ range .Mounts }}{{ printf "\n\t" }}{{ .Type }} {{ if eq .Type "bind" }}{{ .Source }}{{ end }}{{ .Name }} => {{ .Destination }}{{ end }}{{ printf "\n" }}' {}
# Dump raw mount JSON for all containers
docker inspect -f '{{ json .Mounts }}' $(docker ps -a -q) | jq

References