Solve Mysterious MacOS Disk Usage: List and Delete APFS Snapshots

Search for a command to run...

No comments yet. Be the first to comment.
Every team has one complaint that never becomes a proper task. Someone says it, everyone nods, nothing happens. One of our complaints was "the VPN is slow sometimes, or the VPN feels too slow sometime

Why your reactive state fails structured clone, and the fix I shipped.

I built a recipe keeper called Recipe Jar. You paste a recipe link, it gives you a clean card with just the ingredients and steps, and you can save as many recipes as you want. No account, no ads, wor

My Ubuntu server kept freezing. No warning. No error. Just completely stuck. Screen frozen, keyboard dead, only option was to hold the power button and force restart. This happened randomly. Sometimes

Let me tell you about this week(Obv. mine). I pressed the power button on our office’s Ubuntu server. Fans started spinning. CPU light turned on. Everything sounded normal. But the monitor? Completely black. Nothing. Not even the BIOS screen showed u...

I woke up to a full disk panic: Finder said I had almost no space. A quick dive into the terminal revealed something surprising… hundreds of gigabytes tucked away inside /System.
If you encounter mysterious missing space after updates, APFS snapshots are a common suspect. Here’s a clear, safe walkthrough I used to find the culprit and get my machine back to normal.
APFS supports snapshots - point-in-time copies of the filesystem. macOS creates them during system updates (and Time Machine uses them too). Normally, they are cleaned up automatically, but sometimes old snapshots remain and quietly consume space.
Run this to see top-level disk usage (sudo may be required):
sudo du -hxd1 / | sort -hr | head -20
In my case, the output showed:
218G /System
That was the red flag. Drill into /System:
sudo du -hxd1 /System | sort -hr | head -20
I found /System/Volumes that consuming 140+ GB.
List snapshots on the root APFS volume with:
sudo diskutil apfs listSnapshots /
This prints snapshots like com.apple.os.update-YYYY-... along with UUIDs. Those com.apple.os.update-* entries were left behind after macOS updates in my case.
Example output snippet:
Snapshots for APFS Volume with UUID: XXXXX-XXXX-...
Snapshot name: com.apple.os.update-2023-07-12-123456
Snapshot UUID: 01234567-89AB-CDEF-0123-456789ABCDEF
... (more snapshots)
To remove a single snapshot:
sudo diskutil apfs deleteSnapshot / -uuid <SNAPSHOT-UUID>
Replace <SNAPSHOT-UUID> with the UUID from the list. Repeat for unwanted snapshots. Deleting update snapshots is safe if the system is fully booted into the new OS and you don't plan to roll back.
If snapshots refuse to go away or reference in-use files, try one of the following:
Reboot into Safe Mode and try again.
Boot to macOS Recovery and use Terminal from there to delete stubborn snapshots.
Note: on APFS, snapshots are a filesystem feature… deleting them frees the space they were holding, but if you're unsure, booting into Recovery is the safest route.
After removing large snapshots, you can reclaim even more space by cleaning developer caches and unused container data. Use these commands carefully — they remove caches and unused Docker images/containers.
# Homebrew cleanup
brew cleanup
# Docker: remove all unused containers, networks, images (dangling and unreferenced)
docker system prune -af
# Remove user cache (be careful — this deletes files in ~/.cache)
rm -rf ~/.cache/*
# npm cache cleanup
npm cache clean --force
I ran these and got another chunk of space back.
Free space before: ~5 GB
Found: /System ~218 GB, /System/Volumes ~140+ GB
Action: listed APFS snapshots, removed several com.apple.os.update-* snapshots, then ran cache and Docker cleanup
Free space after: ~90+ GB
This saved me from a full macOS reinstall.
APFS snapshots are powerful: deleting an update snapshot removes the ability to roll back to that update. Only delete snapshots when you're confident you won't need to revert.
If macOS or Time Machine is actively using snapshots, the system may prevent deletion until you boot to Recovery or Safe Mode.
Always double-check UUIDs before deleting. A typo can remove the wrong snapshot.
rm -rf ~/.cache/* is destructive: back up anything you care about before mass-deleting caches.
On FileVault-encrypted systems, be extra careful with disk utilities. If in doubt, boot into Recovery and work from there.
Regular maintenance: run brew cleanup occasionally and prune Docker images you no longer need.
Keep an eye on snapshots after system updates for a few days: sometimes automatic cleanup lags.
If you use Time Machine, local snapshots can also consume space - tmutil listlocalsnapshots / shows local Time Machine snapshots.
APFS snapshots can silently hog hundreds of GB — check them when disk usage looks wrong.
Diagnose with sudo du -hxd1 / and sudo diskutil apfs listSnapshots /.
Delete snapshots with sudo diskutil apfs deleteSnapshot / -uuid <UUID>; use Recovery Mode if needed.
Clean developer caches and Docker artifacts (brew cleanup, docker system prune -af, npm cache clean --force) for extra space.
Always double-check what you delete and keep backups for critical data.
If you're in Kathmandu or anywhere in the world and see a surprising /System volume, this process should help you breathe easy again… saved me from reinstalling macOS. Jadau! 🎉