moonlight-lupin Disk Cleanup
Reclaim disk space on a Linux VM. The skill runs a triage — survey every space consumer, split targets into safe vs ask, execute the approved set, then verify the delta.
When to Use
- User says "disk cleanup", "free up space", "clean up the VM"
- Disk usage above 80%
- After large builds, git operations, or Docker image accumulation
Procedure
1. Baseline
df -h
Done: used and available numbers recorded for all mounts for the before/after comparison.
2. Survey
Requires root for apt, journalctl, and /var/log operations. Non-root users can survey but cannot clean system paths.
Build a ranked list of every consumer over ~50M. Survey all mounts, not just /.
# All mounts (not just /)
df -h
df -i # inode exhaustion — "No space left on device" with free blocks
# Deleted-but-open files (canonical "df says full, du says empty" case)
lsof +L1 2>/dev/null | head -20
# Hermes data + user caches + tmp (stay on one filesystem, don't cross mounts)
du -xsh ~/.hermes/*/ 2>/dev/null | sort -rh | head -20
du -xsh ~/.hermes/projects/*/ 2>/dev/null | sort -rh | head -20
du -xsh ~/.cache/*/ 2>/dev/null | sort -rh | head -15
du -xsh /tmp/* 2>/dev/null | sort -rh | head -15
# Memory store (if Mnemosyne is installed)
du -xsh ~/.hermes/mnemosyne/data/* 2>/dev/null | sort -rh
# Session checkpoints (if present)
du -xsh ~/.hermes/checkpoints/store/ 2>/dev/null
# Docker
docker system df # shows build cache separately from images
docker images --format "{{.Size}}\t{{.Repository}}:{{.Tag}}" | sort -rh | head -25
docker ps -a --filter "status=exited" --format "{{.Image}}" | sort -u
# System
du -xsh /var/cache/apt /var/log ~/.cache/pip ~/.cache/uv 2>/dev/null
journalctl --disk-usage
find /var/log \( -name "*.gz" -o -name "*.1" -o -name "*.old" \) 2>/dev/null
# Bloated git repos (orphaned tmp_pack files from interrupted operations)
find ~/.hermes/projects -name ".git" -type d -exec sh -c 'du -sh "$1" 2>/dev/null' _ {} \; | sort -rh | head -10
Done: every consumer over 50M identified with its size. All mounts surveyed. Inode exhaustion and deleted-but-open files checked.
3. Triage
Split every found target into two buckets. Present the table to the user before executing.
Safe — execute without asking:
| Target | Command | Reclaims |
|---|---|---|
| uv cache | uv cache prune |
Up to full cache size |
| pip cache | pip cache purge |
Up to full cache size |
| apt cache | apt autoclean |
~100M typical |
| Journal logs | journalctl --vacuum-size=50M |
Down to 50M |
| Rotated logs | find /var/log \( -name "*.gz" -o -name "*.1" -o -name "*.old" \) -delete |
~20M typical |
| Browser automation caches | rm -rf ~/.cache/puppeteer ~/.cache/ms-playwright |
~650M; re-downloads if needed |
| Dangling Docker images | docker image prune -f |
Varies |
| Docker build cache | docker builder prune -f --filter until=168h --reserved-space 10GB |
Often multi-GB; bounded: skips cache younger than 7 days, always keeps 10GB |
Ask first — user must confirm:
| Target | Risk | Command |
|---|---|---|
| git gc aggressive | Destroys recoverable objects (dropped stashes, orphaned commits after bad reset). Aggressive repack temporarily grows disk use. | cd /repo && git gc --aggressive --prune=now |
| apt autoremove | May remove wanted packages. Review the list before confirming. | apt autoremove (without -y) |
| Old DB backups | Confirm current DB is healthy first. Use explicit paths, not globs. | rm /path/to/specific-backup.bak |
| Stale /tmp dirs | Directory mtime does not track activity inside. List before deleting. | find /tmp -maxdepth 1 -mtime +3 -type d -name "*_*" | xargs ls -ld then confirm |
| Docker images for stopped containers | May want to restart later | docker rmi <image> |
| Session checkpoint stores | May contain recoverable state | — |
| Large skill references (PDFs, maps, RAG indexes) | User data | — |
| Large project uploads | User data | — |
| Docker images for running services | Disruptive | — |
Done: table presented with safe-only total and with-ask total. User has approved a set.
4. Execute
Run the commands from the Safe table for each approved target. Capture before/after size for each.
For Docker stopped containers + images (requires two steps):
docker rm $(docker ps -a --filter "status=exited" --filter "ancestor=IMAGE" -q)
docker rmi IMAGE
Done: every approved target cleaned. Before/after size captured for each.
5. Verify
df -h
Compare per-mount against baseline from step 1.
Done: total reclaimed reported per mount. Used/free compared against baseline.
Pitfalls
| Problem | Cause | Fix |
|---|---|---|
df shows free blocks but writes fail with ENOSPC |
Inode exhaustion — millions of small files. Check df -i. |
Locate with find <mount> -xdev -type f | head -100000 | wc -l per directory, then clear the offending cache/spool. Disk-size cleanup will not help. |
df says full but du shows nothing |
A process holds a deleted file open. Check lsof +L1. |
Identify the holding process with lsof +L1, restart it (or truncate via cat /dev/null > /proc/<pid>/fd/<n>). No file deletion reclaims this. |
git gc reclaims nothing |
No orphaned objects — just large history | Accept the size or run git repack -ad for marginal compression |
| tmp_pack files persist after gc | Git process still running or lock file | fuser .git/objects/pack/*.pack to find the process, retry after it ends |
| Docker rmi fails "image is in use" | Stopped container still references it | docker rm the container first, then docker rmi |
apt autoremove lists wanted packages |
Auto-removable deps flagged incorrectly | Review the list before confirming; skip with apt-mark manual <pkg> |
journalctl --vacuum-size fails |
Journald service issue | systemctl restart systemd-journald then retry |
uv cache prune fails |
uv not in PATH | Use python -m uv cache prune |