Running out of disk space in production

https://alt-romes.github.io/posts/2026-04-01-running-out-of-disk-space-on-launch.html

by romes • 4 months ago

220 125 4 months ago

alt-romes.github.io

flanfly• 4 months ago

A neat trick I was told is to always have ballast files on your systems. Just a few GiB of zeros that you can delete in cases like this. This won't fix the problem, but will buy you time and free space for stuff like lock files so you can get a working system.

jaapz• 4 months ago

Love the simplicity and pragmatism of this solution

omarqureshi• 4 months ago

Surely a 50% warning alarm on disk usage covers this without manual intervention?

jcims• 4 months ago

If the alarms are reliably configured, confirmed to be working, low noise enough to be actioned, etc etc.

And of course there's nothing to say that both of these things can't be done simultaneously.

theshrike79• 4 months ago

Depends. A Kubernetes container might have only a few megabytes of disk space, because it shouldn't need it.

Except that one time when .NET decides that the incoming POST is over some magic limit and it doesn't do the processing in-memory like before, but instead has to write it to disk, crashing the whole pod. Fun times.

Also my Unraid NAS has two drives in "WARNING! 98% USED" alert state. One has 200GB of free space, the other 330GB. Percentages in integers don't work when the starting number is too big :)

dspillett4• 4 months ago

If the alarm works. And it actioned not just snoozed too much or just dismissed entirely.

Defence in depth is a good idea: proper alarms, and a secondary measure in case they don't have the intended effect.

coredog64• 4 months ago

You don't want an alarm on a usage threshold, you want a linear regression that predicts when utilization will cross a threshold. Then you set your alarms for "How long does it take me to remediate this condition?"

evil-olive• 4 months ago

Surely a 50% warning alarm on disk usage covers this without manual intervention?

surely you don't need a fire extinguisher in your kitchen, if you have a smoke detector?

a "warning alarm" is a terrible concept, in general. it's a perfect way to lead to alert fatigue.

over time, you're likely to have someone silence the alarm because there's some host sitting at 57% disk usage for totally normal reasons and they're tired of getting spammed about it.

even well-tuned alert rules (ones that predict growth over time rather than only looking at the current value) tend to be targeted towards catching relatively "slow" leaks of disk usage.

there is always the possibility for a "fast" disk space consumer to fill up the disk more quickly than your alerting system can bring it to your attention and you can fix it. at the extreme end, for example, a standard EBS volume has a throughput of 125mb/sec. something that saturates that limit will fill up 10gb of free space in 80 seconds.

fifilura• 4 months ago

I did this too, but i also zipped the file, turns out it had great packing ratio!

saagarjha• 4 months ago

Personally I just keep the file on a ramdisk so you can avoid having to fetch it from slow storage

ninalanyon• 4 months ago

This is why I never empty the Rubbish Bin/trash Can on my Linux laptop until the disk fills.

zrm3• 4 months ago

That's not a great idea for three different reasons: Filesystems have to do ugly things when they're almost full like split files into many small blocks and store more metadata to keep track of them all, SSDs get slower and have compromised wear leveling when they're almost full, and it makes you more likely to subject yourself to perils of fully running out which can cause random non-temporary problems even if it only happens temporarily.

testplzignore• 4 months ago

Would another way be to drop the reserved space (typically 1% to 5% on an ext file system)?

bombcar2• 4 months ago

Reserved space doesn't protect you against root, who is often the user to blame for the last used MB.

dspillett4• 4 months ago

Similarly, I always leave some space unallocated on LMV volume groups. It means that I can temporarily expand a volume easily if needed.

It also serves to leave some space unused to help out the wear-levelling on the SSDs on which the RAID array that is the PV¹ for LVM. I'm, not 100% sure this is needed any more² but I've not looked into that sufficiently so until I do I'll keep the habit.

--------

[1] if there are multiple PVs, from different drives/arrays, in the VG, then you might need to manually skip a bit on each one because LVM will naturally fill one before using the next. Just allocate a small LV specially on each and don't use it. You can remove one/all of them and add the extents to the fill LV if/when needed. Giving it a useful name also reminds you why that bit of space is carved out.

[2] drives under-allocate by default IIRC

justsomehnguy• 4 months ago

Not needed. All your unused/unfilled space is that space for wear-leveling. It wasn't needed even back then besides some corner cases. And most importantly 10% of the drive in ~2010 were 6-12GB, nowadays it's 50-100GB at least.

PunchyHamster3• 4 months ago

I do that + script to auto resize within sane limits. So for most servers the partitions will automatically fit the usage while still leaving some spare space.

Usually something like "expand if there is less than 5% left, with monitoring triggering when there is 4% free space left", so there is still warning when the automatic resize is on limit

carving space per PV like that is pointless

It also serves to leave some space unused to help out the wear-levelling on the SSDs on which the RAID array that is the PV¹ for LVM. I'm, not 100% sure this is needed any more² but I've not looked into that sufficiently so until I do I'll keep the habit.

YMMV but most distros set up a cron/timer that does fstrim monthly. So it shouldn't be needed, as any free space will be returned to SSD.

[1] if there are multiple PVs, from different drives/arrays, in the VG, then you might need to manually skip a bit on each one because LVM will naturally fill one before using the next. Just allocate a small LV specially on each and don't use it. You can remove one/all of them and add the extents to the fill LV if/when needed. Giving it a useful name also reminds you why that bit of space is carved out.

other options is telling LVM this LV is striped (so it uses space from both drives equally), or manually allocating from drive with more free space when expanding/adding LV

Chaosvex• 4 months ago

Similar to the old game development trick of hiding some memory away and then freeing it up near the end of development when the budget starts getting tight.

bombcar2• 4 months ago

Some filesystems can be unable to delete a file if full. Something to be a bit worried about.

6031769• 4 months ago

Please name and shame those filesystems so that we will all be forewarned.

seized• 4 months ago

Instead of deleting the ballast file you can just truncate it. That works on ZFS when you fill the pool and delete starts failing.

throw0101d2• 4 months ago

A neat trick I was told is to always have ballast files on your systems.

ZFS has a "reservation" mechanism that's handy:

The minimum amount of space guaranteed to a dataset, not including its descendants. When the amount of space used is below this value, the dataset is treated as if it were taking up the amount of space specified by refreservation. The refreservation reservation is accounted for in the parent datasets' space used, and counts against the parent datasets' quotas and reservations.

* https://openzfs.github.io/openzfs-docs/man/master/7/zfsprops...

Quotas prevent users/groups/directories (ZFS datasets) from using too much space, but reservations ensure that particular areas always have a minimum amount set aside for them.

dizhn3• 4 months ago

Also if you VMs on a disk backed by ZFS it's trivial to extend those disks provided you actually do have space on the real disk. (Even automatic with LXC).

throw0101d2• 4 months ago

Typo; link should be:

* https://openzfs.github.io/openzfs-docs/man/master/7/zfsprops...

Addendum: there's also the built-in compression functionality:

When set to on (the default), indicates that the current default compression algorithm should be used. The default balances compression and decompression speed, with compression ratio and is expected to work well on a wide variety of workloads. Unlike all other settings for this property, on does not select a fixed compression type. As new compression algorithms are added to ZFS and enabled on a pool, the default compression algorithm may change. The current default compression algorithm is either lzjb or, if the lz4_compress feature is enabled, lz4.

* https://openzfs.github.io/openzfs-docs/man/master/7/zfsprops...

dijit• 4 months ago

I always called it a “bit-mass”. Like a thermal mass used in freezers in places where the power is not very stable.

I knew I didn’t invent the concept, as there’s so many systems that cannot recover if the disk is totally full. (a write may be required in many systems in order to execute an instruction to remove things gracefully).

The latest thing I found with this issue is Unreal Engines Horde build system, its so tightly coupled with caches, object files and database references: that a manual clean up is extremely difficult and likely to create an unstable system. But you can configure it to have fewer build artefacts kept around and then it will clear itself out gracefully. - but it needs to be able to write to the disk to do it.

Now that I think about it, I don’t do this for inodes, but you can run out of those too and end up in a weird “out of disk” situation despite having lots of usable capacity left.

layer82• 4 months ago

Better fill those files with random bytes, to ensure the filesystem doesn’t apply some “I don’t actually have to store all-zero blocks” sparse-file optimization. To my knowledge no non-compressing file system currently does this, but who knows about the future.

ape44• 4 months ago

If I recall correctly:

    dd if=/dev/urandom of=/home/myrandomfile bs=1 count=N

freedomben2• 4 months ago

Yep, btrfs will happily do this to you. I verified it the hard way

nyrikki3• 4 months ago

XFS, Ext4, btrfs etc… all support sparse files, so any app can cause problems you can try it with:

    dd if=/dev/zero of=sparse_file.img bs=1M count=0 seek=1024

If you add conv=sparse to the dd command with a smaller block size it will sparsify what you copy too, use the wrong cp command flags and they will explode.

Much harder problem than the file system layers to deal with because the stat size will look smaller usually.

zrm3• 4 months ago

A good way to do this is to create a swap file, both because then you can use it as a swap file until you need to delete it and because swap files are required to not be sparse.

PunchyHamster3• 4 months ago

No, just use LVM or other dynamic volume management.

Shit like that just wastes space that SSD could use for wear levelling...

dj0k3r• 4 months ago

I did this recently, aka, docker images prune. Can confirm, saved the day.

HoldOnAMinute• 4 months ago

Sounds like something straight out of Dilbert

happycrappy• 4 months ago

Interesting strategy, can't believe I've never heard of this one before.

Would it be more pragmatic to allocate a swap file instead? Something that provides a theoretical benefit in the short term vs a static reservation.

prmoustache• 4 months ago

Because adding swap file is instantaneous, removing one that is in use can take a longtime unless you reboot the OS so you can't just nuke it quickly.

jasonpeacock• 4 months ago

A neat trick I was told is to always have sleep statements in your code. Just a few sleep statements that you can delete in cases like this. This won't fix the problem, but will buy you time and free up latency for stuff like slow algorithms so you can get faster code.

FTFY ;)

klaushardt• 4 months ago

This is my snippet i used alot. In doubt when even rm wont work just reboot.

Disc Space Insurance File

    fallocate -l 8G /tmp/DELETE_IF_OUT_OF_SPACE.img

https://gist.github.com/klaushardt/9a5f6b0b078d28a23fd968f75...

drybjed• 4 months ago

Make sure your /tmp is on disk and not a tmpfs, like in recent Linux distrubitions.

bguebert• 4 months ago

This saved us a couple times. At least until I had time to add monitoring to their old system to track disk usage. It was also helpful to use a tool called ncdu. It helps you visualize where most disk space is getting used up to track down the problem.

greedo• 4 months ago

ncdu is a lifesaver...

reddalo2• 4 months ago

This trick is actually used by some banking apps.

They fill app their mobile apps with junk data just to make the APK/IPA bigger. So if they need to push an urgent update, they won't have users that can't update because their phones are full to the brim.

I know two Italian banks that do it, Unicredit and Intesa. The latter was on the news when a user found out that one of the filler files was a burp recording [1].

[1] https://www.ilfattoquotidiano.it/2024/12/20/intesa-san-paolo... (in Italian)

Dylan168072• 4 months ago

But you still need a bunch of extra space to download and unpack the new version, and there are so many apps that need to share space, and a banking app should only need about 0.1% of a phone's storage...

Whoever gave them that idea was doing a bad deed.

ikr678• 4 months ago

Doesnt this create an arms race situation where every 'critical' app claims a larger diskspace than necessary, just in case, and accelerates the issue?

triage8004• 4 months ago

Interesting, makes sense, seems to be bad precedent if everyone follows suit.

snthpy• 4 months ago

Great idea, thanks!

johntash• 4 months ago

ext2/ext3/ext4 all automatically reserve an amount of space on a partition. 5% iirc

totetsu• 4 months ago

Also good for stopping phone-home auto firmware updates

PunchyHamster3• 4 months ago

Just use LVM and don't allocate all of it to LV.

We have a script that basically slowly expands volume when demand grows, up to a limit. So we don't have to think on stuff like "does the logs partition need to be 1 or 10GB", it will expand to the sane limit, and if it hits that we get disk usage alert before it finishes so we can either see what's going on (app shat in logs), or take a look for the one in the 10 apps that need some special tuning there

functional_dev• 4 months ago

Such a simple trick, but effective!

entropie• 4 months ago

I rushed to run du -sh on everything I could, as that’s as good as I could manage.

I recently came across gdu (1) and have installed/used it on every machine since then.

[1] https://github.com/dundee/gdu

Neil44• 4 months ago

I also discovered gdu recently. It's really good. It saves me running du -h --max-depth=1 | sort -h a million times trying to find where the space has gone while you're stressing about production being down.

illusive4080• 4 months ago

Have you used ncdu? I wonder how this compares.

NitpickLawyer• 4 months ago

I use dust for this, but gdu looks nice, I'll give it a try. Thanks for sharing.

dizhn3• 4 months ago

gdu is really nice but ncdu, though slower, is very useful and is usually available on distro repos.

seabrookmx• 4 months ago

I can't recommend `dust` enough: https://github.com/bootandy/dust

mixmastamyk• 4 months ago

I have an alias named usage with this in it:

    du -hs -- * .??* 2> /dev/null |  sort -h | tail -$LINES

There's also baobab when a GUI might help.

tcp_handshaker• 4 months ago

One thing that jumps out is the root filesystem, /nix/store, logs, temp files, and application data were all on the same partition. Putting /tmp, /var/log, and /nix on separate mount points (or at least using quotas) is a normal defense against exactly this kind of cascading failure. A runaway temp dir can't break your app ability to send outgoing emails.

The author ended up doing this for /nix under pressure, but it's very much standard best practice in any unix/linux box, especially one with only 40GB.

huijzer• 4 months ago

Plausible Analytics, with a 8.5GB (clickhouse) database

And this is why I tried Plausible once and never looked back.

To get basic but effective analytics, use GoAccess and point it at the Caddy or Nginx logs. It’s written in C and thus barely uses memory. With a few hundreds visits per day, the logs are currently 10 MB per day. Caddy will automatically truncate if logs go above 100 MB.

bdcravens• 4 months ago

I appreciate the last line

Note: this was written fully by me, human.

ivanjermakov• 4 months ago

My fav line from the post is one above it. There is something very blunt and funny about it.

It’s difficult to reason under pressure. Experience, that I didn’t have here, would have helped.

_carbyau_2• 4 months ago

Not me : "Experience is what you get after you needed it."

brunoborges• 4 months ago

I remember a story of an Oracle Database customer who had production broken for days until an Oracle support escalation led to identifying the problem as mere "No disk space left".

AbraKdabra• 4 months ago

Or NTP, if something is not working df -h and date are the first commands I input.

It's always lupu... I mean NTP or disk space.

genewitch3• 3 months ago

i had to ssh to our public nextcloud and run the occ empty-all-trashes-immediately --force --all-users -f command, due to its disk filling up (2.5TB!) and postgres crashing, to boot. empty-trashes command and a reboot and it came right back up.

dirkt• 4 months ago

If you run nginx anyway, why not serve static files from nginx? No need for temporary files, no extra disk space.

The authorization can probably be done somehow in nginx as well.

kccqzy2• 4 months ago

Even if your authorization is so sophisticated that nginx cannot do it, a common pattern I’ve seen is to support a special HTTP response header for the reverse proxy to read directly from disk after your custom authorization code completes. This trick dates back to at least 2010. The nginx version of this seemed to be called X-Accel-Redirect from a quick search.

aftbit• 4 months ago

Yeah it's a bit odd to use a Haskell server to serve a static file which nginx then needs to buffer. You'd do much much better just serving the file out of nginx. You could authenticate requests using the very simple auth_request module:

https://nginx.org/en/docs/http/ngx_http_auth_request_module....

gmuslera• 4 months ago

Putting limits on folders where information may be added (with partitions or project quotas) is a proactive way to avoid that something misbehaves and fills the whole disk. Filling that partition or quota may still cause some problems, depending on the applications writing there, but the impact may be lower and easier to fix than running out of space for everything.

RALaBarge• 4 months ago

Wait until you run out of inodes!

justin_oaks• 4 months ago

That happened to me exactly once in my 20-year career. It was on a web server (maybe even NGINX) that had too many cached files.

Even though it only happened once, I still set up monitoring for inode exhaustion.

lanstin• 4 months ago

Old war story: I had an old Sun 4/260 with 2 1G drives - I had SunOS on 1 and Gentoo on the other - my initial Gentoo install worked for a while but then the portage directory used all the configured iNodes - really weird errors and I could not figure it out at the time; error msgs maybe should mention inodes? I had to do #gentoo-sun IRC and someone suggested df -i which was indeed the issues (solve: you can configure extN filesystems to have more iNodes)

grugdev42• 4 months ago

You missed out point five.

5. Implement infrastructure monitoring.

Assuming you're on something like Ubuntu, the monit program is brilliant.

It's open source and self hosted, configured using plain text files, and can run scripts when thresholds are met.

I personally have it configured to hit a Slack webhook for a monitoring channel. Instant notifications for free!

jollymonATX• 4 months ago

Never partition 100%. Simple solution here really and should be standard for every sysadmin. Like never worked with one that needed to be told this...

nottorp• 4 months ago

Didn't root used to have some reserved space (and a bunch of inodes) on file systems just for occasions like this?

synack• 4 months ago

mkfs.ext4 defaults to 5% reserved for root. -m 0 to turn it off.

renatovico• 4 months ago

Why not implement x send file ?

nyrikki3• 4 months ago

Came here to say this

X-Accel-Redirect (Nginx sendfile), if supported by Haskell is the way, it is zero copy and will dramatically help in many cases.

If you are modifying the body is one of the cases where it doesn’t work.

ilaksh• 4 months ago

I'm not sure that his problems are really over if a LOT of people were downloading a 2GB file. It would depend on the plan. Especially if his server is in the US.

But maybe the European Hetzner servers still have really big limits even for small ones.

But still, if people keep downloading, that could add up.

veverkap• 4 months ago

I was thinking the same thing - wouldn't blob storage or a CDN help?

watermelon0• 4 months ago

European Hetzner VPSes have at least 20 TB of bandwidth, and US ones have at least 1 TB.

I don't think there is a cheaper CDN.

SoftTalker• 4 months ago

I've run into that "process still has deleted files open" situation a few times. df shows disk full, but du can't account for all of it, that's your clue to run lsof and look for "deleted" files that are open.

Even more confusing can be cases where a file is opened, deleted or renamed without being closed, and then a different file is created under the orginal path. To quote the man page, "lsof reports only the path by which the file was opened, not its possibly different final path."

dabinat• 4 months ago

It can be difficult to reason about seemingly innocuous things at scale. I have definitely fallen into the trap of increasing file size from 8 KB to 10 KB and having it cause massive problems when multiplied across all customers at once.

Running out of disk space in production

Related Stories