rm

Updated

September 4, 2026

Overview

rm removes directory entries (unlinks files). By default it does not remove directories unless -r/-R is given. There is no undelete in coreutils — recovery requires backups, snapshots, or filesystem forensics.

Treat rm -rf as a loaded tool: verify the path, prefer dry-runs, and avoid root experiments on broad globs.

Syntax

rm [options] file...

Common Options

Option Description
-r, -R, --recursive Remove directories and their contents
-f, --force Ignore missing files; never prompt
-i Prompt before every removal
-I Prompt once before removing many / recursive
-v, --verbose Print each path as it is removed
-d Remove empty directories (like rmdir)
--one-file-system Do not recurse into different mount points
--preserve-root Refuse to recursively remove / (default on GNU)
--no-preserve-root Dangerous override — do not use casually
--interactive=WHEN never, once, always

Safety

Never experiment with rm -rf /, rm -rf /*, or unquoted root globs as root.

Prefer:

  • Dry-run with find … -print before -delete
  • Move to a quarantine directory first
  • trash-cli / desktop trash when available
  • Snapshots (btrfs/zfs/LVM) for real recovery options

Do not rely on alias rm='rm -i' alone — scripts and other shells bypass aliases.

Examples with Explanations

Files

rm file.txt
rm -v file1 file2
rm -f stale.lock          # no error if missing

Interactive

rm -i *.log
rm -I -r build/           # single confirmation for recursive

Directory trees

rm -r build/
rm -rf build/             # no prompts; double-check path first

Empty directory only

rm -d empty_dir           # fails if not empty
rmdir empty_dir           # clearer intent

Dry-run then delete with find

find ./tmpdir -type f -name '*.tmp' -print
find ./tmpdir -type f -name '*.tmp' -delete
# or interactive:
find ./tmpdir -type f -name '*.tmp' -ok rm {} \;

Stay on one filesystem

sudo rm -r --one-file-system /mnt/usb/data

Avoids descending into unexpected bind mounts.

Quarantine pattern

mkdir -p ~/QUARANTINE
mv suspect_dir ~/QUARANTINE/
# later, after review:
rm -rf ~/QUARANTINE/suspect_dir

Deleted but space held open

rm huge.log
# space may not free until writers close the fd
sudo lsof +L1 | head
sudo lsof | grep '(deleted)'

Notes / Pitfalls

  • Globs expand in the shell before rm runs — rm * is only as safe as your cwd.
  • rm * skips dotfiles; rm -r dir removes dotfiles inside dir.
  • Write permission on the parent directory is required to unlink a name (sticky bit on /tmp restricts deleting others’ files).
  • On CoW/SSD, shred is unreliable for sanitization; use disk encryption and secure erase procedures instead.
  • Root can remove almost anything — accidental paths under /var or /home are common outages.

2026-relevant notes

  • Prefer immutable infrastructure and snapshots over hoping rm is reversible.
  • Container layers: deleting in a running container does not shrink the image; rebuild layers properly.
  • For selective cleanup, find/fd + review beats recursive force from the wrong cwd.

Additional Resources

  • man rm