A disk-pressure alert points at journald and the actual growth comes from rootless container JSON logs under one user's runtime directory that the cleanup job never scans

The host is filling up, yet the expected journal usage remains normal because the unbounded logs are outside the cleanup path.