Docker Engine host administration: daemon.json, disk usage, and live-restore

Goal

Configure the Docker Engine daemon's logging and storage behaviour, check disk usage, and reclaim space without deleting resources still in use.

Prerequisites

Root or membership in the docker group on the host; being in the docker group is equivalent to root on that host, because the daemon runs as root and the group can direct it to bind-mount arbitrary host paths — treat docker group membership with the same care as sudo access.

Steps

1. The daemon reads /etc/docker/daemon.json (JSON) on start; the dockerd reference documents its command-line flags, most of which have a matching JSON key. Common host-level keys:

{
  "data-root": "/var/lib/docker",
  "log-driver": "json-file",
  "log-opts": { "max-size": "10m", "max-file": "3" },
  "live-restore": true
}

2. data-root relocates where images, containers and volumes are stored; moving it requires stopping the daemon (docker.service and docker.socket, otherwise socket activation restarts it), copying the existing directory with ownership, permissions and extended attributes preserved, updating the key, and starting again. This stops all containers, live-restore notwithstanding.
3. log-driver/log-opts set the default logging driver for new containers; without max-size/max-file for the json-file driver, container logs can grow unbounded on disk. Existing containers keep their prior log configuration until recreated.
4. live-restore: true keeps standalone Linux containers running while the daemon is stopped, crashes or is updated to a newer patch release (YY.MM.x); it is not supported across major (YY.MM) upgrades, does not apply to Swarm services, and may fail if daemon options such as the storage driver or bridge addresses changed. While the daemon is down, a container that fills its 64K log pipe buffer blocks on output. Enable it with sudo systemctl reload docker (SIGHUP) rather than a restart, which would stop the running containers because live-restore is not yet active; check with docker info --format '{{.LiveRestore}}'.
5. Apply changes non-interactively: back up daemon.json, validate it with sudo dockerd --validate --config-file /etc/docker/daemon.json (Docker 23.0 and later), then sudo systemctl restart docker (stops containers unless live-restore is already on) or reload for reloadable options. A setting given both in daemon.json and as a flag in the service unit (commonly hosts/-H) makes the daemon refuse to start; watch journalctl -u docker --no-pager. Undo by restoring the backup.
6. Check disk usage by category: docker system df (-v for a per-item breakdown, including reclaimable space).
7. Reclaim space carefully: docker system prune removes all stopped containers, networks not used by a container, dangling images and unused build cache; -a also removes every image not used by a container, and --volumes also removes anonymous volumes not used by a container (named volumes are kept). It prompts for confirmation; -f skips the prompt for scripts. Run docker system df first and prune without -a/--volumes unless you have confirmed nothing needed is only referenced by a stopped container.

Expected result

docker info reflects the new data-root/live-restore values; docker system df shows reduced reclaimable space after a prune, with active containers and their images untouched.

Limits and test basis

docker system prune's exact scope is controlled by its flags and has changed between releases (older engines also removed unused named volumes with --volumes); running it without reviewing docker system df first can delete a stopped container still needed for a scheduled job.