Docker Clean Safe

Docker Clean Safe

Clean unused Docker resources with the bundled script. Treat farmnet:local and all currently running containers as mandatory preservation targets.

Workflow

1. Run scripts/clean_docker.sh --dry-run to verify Docker is reachable and inventory the current cleanup candidates. This is read-only.
2. Summarize the report for the user before any mutation. State what each candidate currently is, why Docker considers it unused, what deleting it affects, and whether it can be recovered.
3. Warn prominently about volumes: deleting an unused volume permanently removes its stored data from Docker. Docker cannot restore it; recovery requires an existing external backup.
4. Ask the user to explicitly confirm this specific cleanup plan. The original request to clean Docker does not count as confirmation because it happened before the inventory and impact report.
5. Wait for the answer. Do not run a cleanup command when the user has not clearly confirmed, has questions, or wants exclusions.
6. After confirmation, run scripts/clean_docker.sh --confirm-plan PLAN_ID using the plan ID printed by the dry run. The script recomputes the inventory and aborts without deleting anything if it changed, so show the new plan and ask again in that case.
7. Report reclaimed disk space, the number of running containers preserved, and confirmation that farmnet:local remains.

Confirmation Report

Include these points concisely:

• Stopped containers: names/IDs and current status. Their writable layer, logs, and container configuration are deleted. They can usually be recreated from Compose or an image, but local-only changes are not recoverable.
• Unused images: repository/tag or image ID. They no longer have an associated container. They can be pulled or rebuilt only when the source/registry still exists; local-only images may not be recoverable.
• Unused networks: names/IDs. No container currently uses them. They are normally recreated by Compose, but custom configuration must be recreated manually if it is not defined elsewhere.
• Unused volumes: names. No container currently references them. Their data is permanently deleted and recoverable only from a separate backup.
• Build cache: current reclaimable cache reported by Docker. Deleting it affects only future build speed and it is regenerated by rebuilding.
• Protected resources: number of running containers and the protected image.

End with a direct question such as: Bạn xác nhận xóa đúng các tài nguyên trên không?

Safety Rules

• Never stop, restart, or remove a running container.
• Never run docker system prune, because it cannot explicitly protect farmnet:local.
• Never delete from the user's initial cleanup request alone. Explicit confirmation must come after the inventory and impact report.
• Never reuse confirmation when the plan ID changes; show the updated candidates and ask again.
• Abort before mutation when farmnet:local does not exist.
• Protect farmnet:local with a temporary stopped container during image pruning.
• Remove only Docker resources that Docker classifies as unused.
• Run cleanup commands sequentially; do not combine them into an opaque shell command.
• If the user names a different protected image, pass it through --keep-image IMAGE.
• Do not delete bind-mounted host files or directories.

Script

Use:

scripts/clean_docker.sh --dry-run
scripts/clean_docker.sh --confirm-plan PLAN_ID

The script prunes stopped containers, unused images, unused networks, unused volumes, and build cache. It validates that every container running at startup remains running and that the protected image still exists.