diff --git a/skills/kvb-cleanup/docker.md b/skills/kvb-cleanup/docker.md index d781d1f..30b2281 100644 --- a/skills/kvb-cleanup/docker.md +++ b/skills/kvb-cleanup/docker.md @@ -2,31 +2,25 @@ ## Inventory -`docker system df -v`; containers with state and compose project label, -volumes with the containers using them (`docker ps -a --filter -volume=`), dangling and unused images, build cache, unused networks. -For every stopped container (`exited`, `created`) record its volumes -(`{{.Mounts}}`); for every volume no running container uses, record size, -`CreatedAt` (`docker volume inspect`) and compose project label, anonymous -ones included. +`docker system df -v`: containers with state and compose project, volumes +with their users (`docker ps -a --filter volume=`), dangling and unused +images, build cache, unused networks. An untagged image with `RepoDigests` +is a digest-pinned pull: medium. Per stopped container its volumes +(`{{.Mounts}}`); per volume without a running user its size, `CreatedAt` and +compose project, anonymous ones included. ## Volumes checklist -Stopped containers and volumes always get their own checklist -(`multiSelect: true`, header `⚠ Volumes`, in a further call when call 1 is -full). Every stopped container and every volume without a running container -appears there unless a peer claimed it; none is dropped as "not proposed", -`unknown` and anonymous ones included. The question text carries the warning: +Stopped containers and volumes get their own checklist (`multiSelect: true`, +header `⚠ Volumes`, a further call when call 1 is full), each one unless a +peer claimed it, `unknown` and anonymous ones included. Question text: `Deleting a volume is irreversible; its data does not come back unless the -description says how.` One option per stopped container together with its -volumes (removing the container alone frees nothing of them), one per -unattached volume, anonymous ones grouped. Each description gives size, -`CreatedAt`, owner or compose project, and what is lost. +description says how.` One option per stopped container with its volumes, +one per unattached volume, anonymous ones grouped; each names size, +`CreatedAt`, owner or project, and what is lost. ## After removing images -Locally built images free little on their own: their layers stay behind as -build cache. Re-measure `docker system df`; the layers show up as reclaimable -build cache. Offer `docker builder prune --filter until=24h` as a follow-up -candidate, ask the peers that claimed build cache first, and run it outside -their running builds. +Built images leave their layers as build cache: re-measure `docker system +df`, then offer `docker builder prune --filter until=24h`, after asking the +peers that claimed build cache, outside their builds. diff --git a/skills/kvb-cleanup/worktrees.md b/skills/kvb-cleanup/worktrees.md index 100c943..9731e70 100644 --- a/skills/kvb-cleanup/worktrees.md +++ b/skills/kvb-cleanup/worktrees.md @@ -2,20 +2,25 @@ ## Inventory -Per worktree: size (`du -sh`), dirty state (`git status --short`), whether -its branch is pushed, and whether its HEAD is already contained in an -integration line: the default branch and every branch the project merges -features into (ask the operator or the project's memory which ones). With -`pkgmgr` installed, `pkgmgr branch gc --json --sizes --merged-into ` -(one per line) measures all of it; its merged-clean items go to the +Per worktree: size (`du -sh`), dirty state, whether its branch is pushed and +whether its HEAD is in an integration line (the default branch and every +branch the project merges features into; ask the operator or the project's +memory). With `pkgmgr`, `pkgmgr branch gc --json --sizes --merged-into +` (one per line) measures it all; merged-clean items go to the `kvb-git-branch-gc` skill. -A clean worktree whose HEAD is in an integration line is medium risk: its -ignored files (`node_modules`, build output, evidence) are lost, no commit. +Clean and in a line: medium, its ignored files (`node_modules`, build output, +evidence) are lost. Dirty: a candidate only when every changed, staged and +untracked file is a blob at some branch tip and a detached HEAD is reachable +from another ref; else it is unique work and stays. ## Removal -Remove a worktree the way it was made: a slot worktree through the project's -teardown target (e.g. `make worktree-down`), run outside the sandbox; a plain -sidetree through `git worktree remove` without `--force`, which refuses a -dirty tree. +The way it was made: a slot worktree through the project's teardown target +(e.g. `make worktree-down`), a sidetree through `git worktree remove`, +`--force` only for a dirty one cleared above. Never in an agent sandbox: its +read-only `.git/worktrees/` mounts make git unregister and then fail with +`Device or resource busy`, container-owned files with `Permission denied`. +Hand the operator in one message, per worktree, its count of `find -not +-user "$USER" -prune | wc -l`, `sudo chown -R "$USER": ` where it is not +0, then the removal command.