My /var ran full, the culprit was /var/lib/containers/storage/overlay-containers//userdata/ctr.log of my gitlab container, wh
/var
/var/lib/containers/storage/overlay-containers//userdata/ctr.log