The disk is full and I do not know what is safe to delete

The three that catch people, because the space does not show up where they look:

A deleted file still held open. A process holding a deleted log file keeps the space allocated until it closes it, so du says the space is free and df says it is not. lsof +L1 lists them, and restarting the offending service releases the space. This is the classic "I deleted it and nothing changed".

Files hidden under a mount point. If something was written to a directory before a disk was mounted over it, the data is still there and invisible. Mounting the root filesystem elsewhere and looking is the only way to see it.

Snapshots. On filesystems with snapshots, deleting a file frees nothing while a snapshot references it. df says full, everything you can see is small, and the answer is to expire snapshots.

Any of those three explains the case where you delete a lot and the free space does not move.

Find it before deleting anything. Two commands answer almost every case.

df -h                    # which filesystem is full
sudo du -xh / | sort -h | tail -40

The -x matters — it stops du wandering into other mounted filesystems and giving you a total that means nothing. If you have an interactive tool available, ncdu -x / is the same information you can walk around in, and it is worth installing while you still have the space to install it.

The usual culprits, in the order I find them:

• Logs. Systemd's journal grows until told not to. journalctl --disk-usage reports it and journalctl --vacuum-size=200M trims it, permanently once you set the limit in the configuration.
• The package cache. Every distribution keeps downloaded packages after installing them. Clearing it is entirely safe.
• Old kernels, which is the same problem as a full boot partition.
• Container images and volumes, which is usually the answer on a machine running anything containerised.

What is safe, stated plainly:

Safe: the package cache, the journal beyond your retention, old kernels other than the running one and one fallback, container images and build caches you can rebuild, thumbnail and browser caches under home directories, files in temporary directories.

Safe with thought: old backups, log archives, anything under /var/lib belonging to software you no longer run.

Not safe: anything under the system binaries and libraries, configuration, or a running service's data directory. If you find yourself considering these, the disk is too small rather than too full, and the answer is more storage or moving the data.

The general rule: delete things that a program will recreate, and never things a program expects to find.