On Wed, May 13, 2026 at 07:49:25PM -0400, Giles Orr via Talk wrote:
I have a system with Debian 13 installed. I was installing something on the machine and ran out of space on the root partition (big Docker image). After it aborted the install, here's the output of `df`:
# df -h Filesystem Size Used Avail Use% Mounted on ... /dev/mapper/brick_lvm-os2 24G 21G 2.6G 90% / ...
Here's the output of `ncdu -x /`:
8.4 GiB [#############] /usr
3.2 GiB [#### ] /var 296.6 MiB [ ] /boot 99.5 MiB [ ] /root 19.4 MiB [ ] /etc 16.0 KiB [ ] /media 16.0 KiB [ ] /opt e 16.0 KiB [ ] /lost+found 12.0 KiB [ ] /mnt ... *Total disk usage: 11.9 GiB Apparent size: 11.6 GiB Items: 344362
You see the problem? `ncdu` thinks 12G is used, but `df` thinks that 21G is used. That's one hell of a discrepancy. A web search yielded the idea of running `lsof | grep deleted` which turned up Firefox as a major offender ... but killing FF got rid of its hundreds of "deleted" items while not changing what `df` thought at all.
I remember you can hide disk usage under mount points. But that was an old trick one hundred years ago on multi-user systems. One that I'd be unlikely to play on myself as this isn't a multi-user system.
Other things I checked: no, there isn't a giant swap file sitting in the root. No, this problem doesn't exist on my main machine (or, I think, any of my others). The one unusual thing about this system is that ZFS is installed and there are two other mirrored drives. Root is hosted on a separate drive, so I don't think ZFS would be quietly eating huge chunks of this non-ZFS drive? (I am not a ZFS expert.)
This is an LVM system and I have spare space that I can throw at the problem - but I'd really really like to understand what's going on!
Anybody seen anything like this? Any ideas what would cause this discrepancy or how to track it down? Thanks.
If you were to place a 10GB file in /mnt and then mount a different drive on top of /mnt, df would know the 10GB was used, but du would not be able to see it since the file is hidden by the mount on top of the directory. Also in the case of zfs, df accounts for snapshot used space, which du does not. Also zfs does asynch deletion, so until a large file is actually fully deleted, it won't show as free in df. I doubt that is the case here though. My guess is the snapshot part. -- Len Sorensen