fix: use random suffix for process temp directory instead of PID (aquasecurity#10431)

Author: dcoppa

pkg/x/os/os.go

@@ -1,9 +1,7 @@
 package os
 
 import (
-	"fmt"
 	"os"
-	"path/filepath"
 	"sync"
 	"sync/atomic"
 
@@ -19,12 +17,13 @@ var (
 	initialized atomic.Bool
 )
 
-// initTempDir initializes the process-specific temp directory
+// initTempDir initializes a unique temp directory for this process.
+// Uses os.MkdirTemp to generate a random suffix, avoiding collisions when
+// multiple processes share the same /tmp (e.g. Kubernetes emptyDir volumes
+// where all containers run as PID 1).
 func initTempDir() (string, error) {
-	pid := os.Getpid()
-	tempDir := filepath.Join(os.TempDir(), fmt.Sprintf("trivy-%d", pid))
-
-	if err := os.MkdirAll(tempDir, 0o755); err != nil {
+	tempDir, err := os.MkdirTemp(os.TempDir(), "trivy-") //nolint: gocritic
+	if err != nil {
 		return "", xerrors.Errorf("failed to create temp dir: %w", err)
 	}
 
@@ -71,8 +70,10 @@ func TempDir() string {
 	return tempDir
 }
 
-// Cleanup removes the entire process-specific temp directory
-// Note: On Windows, directory deletion may fail if files are still open
+// Cleanup removes the entire process-specific temp directory.
+// Note: After Cleanup(), TempDir() will still return the deleted path.
+// Callers should not use TempDir() after Cleanup().
+// Note: On Windows, directory deletion may fail if files are still open.
 func Cleanup() error {
 	// If temp dir was never initialized, nothing to clean up
 	if !initialized.Load() {

pkg/x/os/os_test.go

@@ -3,7 +3,6 @@ package os
 import (
 	"os"
 	"path/filepath"
-	"strconv"
 	"strings"
 	"sync"
 	"testing"
@@ -12,9 +11,10 @@ import (
 	"github.com/stretchr/testify/require"
 )
 
-// resetForTest resets global variables for testing
+// resetForTest resets all global state for testing
 func resetForTest() {
 	tempDirOnce = sync.OnceValues(initTempDir)
+	initialized.Store(false)
 }
 
 func TestTempDir(t *testing.T) {
@@ -26,10 +26,8 @@ func TestTempDir(t *testing.T) {
 
 	got := TempDir()
 
-	// Should contain process ID
-	pid := os.Getpid()
-	want := filepath.Join(os.TempDir(), "trivy-"+strconv.Itoa(pid))
-	assert.Equal(t, want, got)
+	// Should be under system temp dir with trivy- prefix
+	assert.True(t, strings.HasPrefix(got, filepath.Join(os.TempDir(), "trivy-")))
 
 	// Directory should exist
 	_, err := os.Stat(got)
@@ -72,10 +70,8 @@ func TestCreateTemp(t *testing.T) {
 			_, err = os.Stat(file.Name())
 			require.NoError(t, err)
 
-			// File should be in our temp directory
-			pid := os.Getpid()
-			expectedDir := filepath.Join(os.TempDir(), "trivy-"+strconv.Itoa(pid))
-			assert.True(t, strings.HasPrefix(file.Name(), expectedDir))
+			// File should be under a trivy- prefixed temp directory
+			assert.True(t, strings.HasPrefix(file.Name(), filepath.Join(os.TempDir(), "trivy-")))
 
 			// Test with specific dir
 			customDir := t.TempDir()
@@ -123,9 +119,8 @@ func TestMkdirTemp(t *testing.T) {
 			_, err = os.Stat(dir)
 			require.NoError(t, err)
 
-			// Directory should be in our temp directory
-			wantParent := filepath.Join(os.TempDir(), "trivy-"+strconv.Itoa(os.Getpid()))
-			assert.True(t, strings.HasPrefix(dir, wantParent))
+			// Directory should be under a trivy- prefixed temp directory
+			assert.True(t, strings.HasPrefix(dir, filepath.Join(os.TempDir(), "trivy-")))
 
 			// Test with specific dir
 			customParent := t.TempDir()
@@ -152,8 +147,8 @@ func TestCleanup(t *testing.T) {
 	filename := file.Name()
 	require.NoError(t, file.Close())
 
-	// Directory should exist
-	dir := filepath.Join(os.TempDir(), "trivy-"+strconv.Itoa(os.Getpid()))
+	// Get the trivy temp directory (parent of the file)
+	dir := TempDir()
 	_, err = os.Stat(dir)
 	require.NoError(t, err)
 
@@ -173,3 +168,22 @@ func TestCleanup(t *testing.T) {
 	_, err = os.Stat(dir)
 	assert.ErrorIs(t, err, os.ErrNotExist)
 }
+
+func TestTempDirUniqueness(t *testing.T) {
+	// Each call to initTempDir should produce a unique directory
+	resetForTest()
+	dir1 := TempDir()
+	t.Cleanup(func() {
+		_ = os.RemoveAll(dir1)
+	})
+
+	// Reset and get another dir
+	resetForTest()
+	dir2 := TempDir()
+	t.Cleanup(func() {
+		_ = os.RemoveAll(dir2)
+		resetForTest()
+	})
+
+	assert.NotEqual(t, dir1, dir2, "two separate initializations should produce different directories")
+}