# Docker Clean Safe

> Safely inspect and clean unused Docker containers, images, networks, volumes, and build cache while preserving every running container and the farmnet:local image. Always inventory the exact cleanup candidates, explain impact and recoverability, and obtain explicit confirmation before deleting anything. Use when the user says "clean docker", "dọn Docker", asks to free Docker disk space without downtime, or requests Docker cleanup that must not affect running services or farmnet:local.

- Skill: `nguyenhuy158/docker-clean-safe` (Agent Skill, multi-file: 3 files)
- Install (CLI): `npx skillmds@latest add nguyenhuy158/docker-clean-safe`
- Raw SKILL.md: https://api.skillmd.com/api/skills/nguyenhuy158/docker-clean-safe/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: DevOps & Infra
- Author: nguyenhuy158 (https://skillmd.com/u/nguyenhuy158)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/nguyenhuy158/docker-clean-safe

---


# Docker Clean Safe

Clean unused Docker resources with the bundled script. Treat `farmnet:local` and all currently running containers as mandatory preservation targets.

## Workflow

1. Run `scripts/clean_docker.sh --dry-run` to verify Docker is reachable and inventory the current cleanup candidates. This is read-only.
2. Summarize the report for the user before any mutation. State what each candidate currently is, why Docker considers it unused, what deleting it affects, and whether it can be recovered.
3. Warn prominently about volumes: deleting an unused volume permanently removes its stored data from Docker. Docker cannot restore it; recovery requires an existing external backup.
4. Ask the user to explicitly confirm this specific cleanup plan. The original request to clean Docker does not count as confirmation because it happened before the inventory and impact report.
5. Wait for the answer. Do not run a cleanup command when the user has not clearly confirmed, has questions, or wants exclusions.
6. After confirmation, run `scripts/clean_docker.sh --confirm-plan PLAN_ID` using the plan ID printed by the dry run. The script recomputes the inventory and aborts without deleting anything if it changed, so show the new plan and ask again in that case.
7. Report reclaimed disk space, the number of running containers preserved, and confirmation that `farmnet:local` remains.

## Confirmation Report

Include these points concisely:

- Stopped containers: names/IDs and current status. Their writable layer, logs, and container configuration are deleted. They can usually be recreated from Compose or an image, but local-only changes are not recoverable.
- Unused images: repository/tag or image ID. They no longer have an associated container. They can be pulled or rebuilt only when the source/registry still exists; local-only images may not be recoverable.
- Unused networks: names/IDs. No container currently uses them. They are normally recreated by Compose, but custom configuration must be recreated manually if it is not defined elsewhere.
- Unused volumes: names. No container currently references them. Their data is permanently deleted and recoverable only from a separate backup.
- Build cache: current reclaimable cache reported by Docker. Deleting it affects only future build speed and it is regenerated by rebuilding.
- Protected resources: number of running containers and the protected image.

End with a direct question such as: `Bạn xác nhận xóa đúng các tài nguyên trên không?`

## Safety Rules

- Never stop, restart, or remove a running container.
- Never run `docker system prune`, because it cannot explicitly protect `farmnet:local`.
- Never delete from the user's initial cleanup request alone. Explicit confirmation must come after the inventory and impact report.
- Never reuse confirmation when the plan ID changes; show the updated candidates and ask again.
- Abort before mutation when `farmnet:local` does not exist.
- Protect `farmnet:local` with a temporary stopped container during image pruning.
- Remove only Docker resources that Docker classifies as unused.
- Run cleanup commands sequentially; do not combine them into an opaque shell command.
- If the user names a different protected image, pass it through `--keep-image IMAGE`.
- Do not delete bind-mounted host files or directories.

## Script

Use:

```bash
scripts/clean_docker.sh --dry-run
scripts/clean_docker.sh --confirm-plan PLAN_ID
```

The script prunes stopped containers, unused images, unused networks, unused volumes, and build cache. It validates that every container running at startup remains running and that the protected image still exists.