Q: A junior engineer executed `docker system prune -a --volumes -f` on a staging server to free up disk space, accidentally deleting production-mirror database volumes and wiping uncommitted test databases. On other CI nodes, unmaintained Docker hosts frequently run out of disk space due to hundreds of gigabytes of dangling images and BuildKit cache layers. You must design an automated, safe maintenance strategy that prunes stale resources using age filters without risking persistent volumes.

Understand command scopes: `docker image prune` removes dangling (``) images. `docker container prune` cleans stopped containers. `docker system prune -a` removes all unused images (not just dangling ones). Adding `--volumes` destroys all anonymous and unused named volumes, posing catastrophic data loss risks.

<!-- Prune Command Danger Levels -->
SAFE:        docker image prune                                (Removes dangling layers only)
CONTROLLED:  docker system prune --filter "until=168h"         (Removes stopped containers & untagged images > 7 days old)
DANGEROUS:   docker system prune -a                            (Removes ALL images not actively running!)
CATASTROPHIC: docker system prune -a --volumes                 (Destroys all unused persistent volumes!)

Always qualify automated pruning scripts with the `until` filter (e.g., `until=72h` or `until=168h`), ensuring that recently stopped containers and recently downloaded base images are preserved for developer cache.

# Prune stopped containers older than 3 days
docker container prune --filter "until=72h" -f

# Prune unused images created more than 7 days ago (without touching volumes)
docker image prune -a --filter "until=168h" -f

Rather than relying on manual cron jobs, configure BuildKit's native garbage collector in `/etc/docker/daemon.json` to enforce strict disk storage ceilings.

cat <<EOF | sudo tee /etc/docker/daemon.json
{
  "builder": {
    "gc": {
      "enabled": true,
      "defaultKeepStorage": "20GB",
      "policy": [
        {"keepBytes": 10737418240, "all": false},
        {"keepBytes": 21474836480, "all": true}
      ]
    }
  }
}
EOF

Create a hardened systemd service and timer running weekly that safely trims orphaned build layers and dangling images while strictly excluding `--volumes`.

# /etc/systemd/system/docker-prune.service
[Unit]
Description=Safe Docker Host Prune
[Service]
Type=Oneshot
ExecStart=/usr/bin/docker system prune -f --filter "until=168h"