Date: 2026-03-06
Context: Root LV was 100% full (100GB LV on 235GB VG). LV expanded to 235GB same night.
Current state after expansion: 232GB total, ~93GB used, 128GB free (43%)
| Path | Size | Description |
|---|---|---|
/opt/docker/docker-engine |
206GB | containerd image/layer store (Docker images + volumes) |
/opt/docker/backups/192.168.11.89 |
105GB | rsync backup of .89 filesystem landing on root LV |
/var/lib/containerd |
40GB | Second containerd store (overlapping with above) |
/tmp/ |
15GB | Leftover zip files, RRD data, junk |
/var/log |
5.2GB | auth.log bloat (SSH brute force attempts) |
/home/nate |
12GB | iCloud sync working dir, etc. |
swap.img |
8.1GB | Normal |
The #1 problem: The rsync backup job from .89 is writing 105GB of backup data to the
root LV on .18. Backups should land on /mnt/macdrive (3.6TB ext4, now freshly formatted)
or another dedicated volume — NOT the OS disk.
# These are confirmed leftover files — safe to delete
sudo rm -f /tmp/exosquad-s-02-e-06-mind-set_202412.zip
sudo rm -f /tmp/the-adventures-of-pete-pete-s-03-e-11-o-christmas-pete-facebook.-nick.-vhs.-vhsr.zip
sudo rm -rf /tmp/rrd_data
sudo rm -f /tmp/hacs.zip
sudo rm -f /tmp/raw_serial.txt
sudo rm -f /tmp/observium.sql
sudo rm -f /tmp/test_image.jpg
# Clean any other leftover claude working dirs
sudo rm -rf /tmp/doorcounty-wi /tmp/doorcounty-wi-readme /tmp/claude-1000
Estimated recovery: ~15GB
sudo docker builder prune -f
Estimated recovery: ~5.7GB
These images have no running container and are not referenced by any compose file:
sudo docker rmi nvidia/cuda:12.2.0-base-ubuntu22.04
sudo docker rmi ghcr.io/esphome/esphome:2026.3.3
sudo docker image prune -f # catch any other dangling images
Estimated recovery: ~1.5GB
sudo docker rm keen_blackburn optimistic_leavitt
sudo docker rmi hello-world
sudo truncate -s 0 /var/log/auth.log
sudo truncate -s 0 /var/log/auth.log.1
sudo journalctl --vacuum-size=500M
Estimated recovery: ~1GB
Note: The auth.log bloat is caused by SSH brute force attempts on a public-facing port.
Consider changing the SSH port or adding fail2ban if not already present.
sudo docker rm doorcounty-scanner && sudo docker rmi doorcounty-scanner:latestgraylog-mongodb is in a restart loop (exit code 14, ~28s intervals)unhealthy statussudo docker logs graylog-mongodb --tail=50)ultralytics/ultralytics:latest (13.5GB image)The rsync backup of 192.168.11.89 is writing to /opt/docker/backups/ which is on
the root LV. This will fill the disk again over time.
Target: /mnt/macdrive (3.6TB ext4, freshly formatted 2026-03-06, mounted at /mnt/macdrive)
Steps:
sudo crontab -l
sudo cat /etc/cron.d/*
sudo find /opt /home -name "*.sh" | xargs grep -l "rsync" 2>/dev/null
/opt/docker/backups/ to /mnt/macdrive/backups//mnt/macdrive to /etc/fstab for auto-mount on reboot (if not already done)sudo mv /opt/docker/backups/192.168.11.89 /mnt/macdrive/backups/This alone recovers 105GB on the root LV.
ubuntu-vg on 192.168.11.18sudo lvextend -l +100%FREE /dev/ubuntu-vg/ubuntu-lv && sudo resize2fs /dev/ubuntu-vg/ubuntu-lv| Action | Recovery | Risk |
|---|---|---|
| Clear /tmp junk | ~15GB | None |
| Docker build cache | ~5.7GB | None |
| Orphaned images (CUDA, ESPHome) | ~1.5GB | None |
| hello-world containers | trivial | None |
| Truncate auth.log | ~1GB | None |
| doorcounty-scanner image | ~4.3GB | Low (confirm first) |
| Move backups to /mnt/macdrive | ~105GB | Low (update rsync script) |
| TOTAL | ~133GB |