Audit Docker Space, State and Events with docker system

docker system is the command group behind a fast Docker host check: disk use, recent events, and whether cleanup is safe. The examples use Docker Community Edition CLI 29.8.1 from docker-ce-cli package version 5:29.8.1-1~ubuntu.24.04~noble.

Allow about fifteen minutes. You need the Docker CLI and access to the selected Docker daemon. Most of these are ordinary user commands, but daemon access may be restricted by your Docker context or socket permissions. Do not reach for sudo automatically: it can select a different configuration and context, and it will not fix a wrong target daemon.

1. Confirm the command group and daemon

Start with the group's own help. This is read-only and does not touch the daemon:

$ docker system --help
Usage:  docker system COMMAND

Manage Docker

Commands:
  df          Show docker disk usage
  events      Get real time events from the server
  info        Display system-wide information
  prune       Remove unused data

The group is a menu, not one operation. docker system prune changes state; df, events and info only inspect it.

$ docker system info
Client: Docker Engine - Community
 Version:    29.8.1
Context:    default
...
Server:
 Containers: 48
 Images: 32
 Storage Driver: overlayfs

Your counts and storage driver will differ. A successful result confirms both the CLI version and the server reached through the current context. If it fails with a socket or permission error, check docker context show, the daemon service and the account's access. A successful command against the wrong context is still a failed investigation.

2. Measure what is using disk

Run the disk report before deciding what to delete:

$ docker system df
TYPE            TOTAL     ACTIVE    SIZE      RECLAIMABLE
Images          32        28        14.79GB   36.76MB (0%)
Containers      48        48        223.3MB   0B (0%)
Local Volumes   17        5         12.22GB   11.93GB (97%)
Build Cache     132       0         6.266GB   6.218GB

Read RECLAIMABLE as an estimate of objects Docker considers unused, not a promise that a future command removes every byte. Volumes need extra care: they can hold application data, and a volume that looks unused may still matter once a workload is recreated.

For per-object detail, add --verbose. For machine-readable output, use the documented JSON format:

$ docker system df --format json
{...}

The exact JSON fields and values depend on the daemon. Save the output for an audit trail if you need one, but do not parse the human table in a script.

3. Inspect recent daemon activity

docker system events streams new events indefinitely unless you bound it. Use a short time window for a one-off check:

$ docker system events --since 10m --until 0s
2026-09-23T10:20:31.000000000Z container start ...
2026-09-23T10:20:33.000000000Z container die ...

The timestamps and event types are host-specific. --since and --until accept Unix timestamps, formatted dates or Go duration strings such as 10m. Without --since, the command just waits for new events, which catches out anyone expecting a one-off report.

Filter noisy output when investigating one class of object:

$ docker system events --since 10m --until 0s --filter 'type=container'

Quote filter values so the shell does not reinterpret them. Use the event stream to correlate a restart, removal or network change with another operation; it is not a replacement for service logs.

4. Review prune boundaries before changing state

• Default targets. docker system prune removes stopped containers, unused networks, dangling images and unused build cache by default. It does not remove volumes by default.
• Wider options exist. --all also targets unused images that are still tagged; --volumes includes unused anonymous volumes. Named volumes stay outside this command's normal scope, but that is no reason to treat volume data casually.

Use a filter to narrow the candidate set where the daemon supports the expression you need:

$ docker system prune --filter 'until=24h'
WARNING! This will remove:
        - all stopped containers
        - all networks not used by at least one container
        - all dangling images
        - unused build cache
Are you sure you want to continue? [y/N]

At the prompt, answer N or press Enter to cancel. There is no dry-run mode, so treat docker system df --verbose, your container and volume inventories, and the filter itself as your review step. If you need to preserve data, back it up or remove only a more specific object type with its dedicated prune command.

5. Put the checks into a safe routine

Run the read-only checks together and stop on the first failure:

set -eu
docker system info > /tmp/docker-system-info.txt
docker system df --verbose
docker system events --since 10m --until 0s --filter 'type=container'
printf '%s\n' 'Docker system audit completed'

This writes only a temporary information report and does not alter Docker objects. Remove that report once it is no longer needed if it contains host details. Keep the prune command out of automation until its object and age policy has been reviewed by the service owner.