RUN --cache=type=mount writes to /var/tmp on the root partition instead of /var/home like rootless containers with rpm-ostree

[westurner]

A podman build of a Containerfile with RUN --cache=type=mount writes to /var/tmp on the root partition instead of /var/home.
On rpm-ostree distros, /var/tmp is by default on a different partition than rootless containers (with rpm-ostree distros).

It is surprising then that podman needs disk space on /var/tmp to build rootless containers if there are RUN --cache mounts.

Silverblue (and other rpm-ostree distros) have limited size root partitions by default. Rootless containers are stored in homedirs on the /var/home partition (where there's plenty of space by default).

$ podman info | grep /var/tmp
  imageCopyTmpDir: /var/tmp

Should rpm-ostree distros like Silverblue set imageCopyTmpDir (and/or other config values) to IDK ${HOME}/.cache/podman for rootless containers where / is limited in space and writes need to be contained to partitions with space?

[westurner]

@rhatdan Should rootless container (edit: builds) write to space-limited /var/tmp on rpm-ostree distros?

[giuseppe]

I think /var/tmp is a sane default that works on most systems and systemd takes care of removing old files, if you'd like to use something else you can customize it through the containers.conf file

[westurner]

Given that /var/tmp is just a directory on / (and not a faster spool or similar),

I guess I want to set it to a per-user ${HOME}/.cache/tmp (on the /var/home partition) so that rootless container builds don't and can't fill up the root partition.

[westurner]

What about /run?

https://en.wikipedia.org/wiki/Filesystem_Hierarchy_Standard ::

/run Run-time variable data: Information about the running system since last boot, e.g., currently logged-in users and running daemons. Files under this directory must be either removed or truncated at the beginning of the boot process, but this is not necessary on systems that provide this directory as a temporary filesystem (tmpfs) (appeared in FHS-3.0 in 2015).

Where do the /run tmpfs mounts store data on disk?

Is it that any tmpfs (e.g. /run/user/1000) can fill up /tmp, which can exhaust the resources of the root partition (by default; though containers.conf)

$ ls -aldZ /run /tmp /sysroot/run /sysroot/tmp /run/user/1000
drwxr-xr-x. 61 root    root    system_u:object_r:var_run_t:s0      1560 May  5 10:14 /run
drwx------. 22 user    user    unconfined_u:object_r:user_tmp_t:s0  660 May  8 04:40 /run/user/1000
drwxr-xr-x.  2 root    root    system_u:object_r:root_t:s0         4096 Jul 18  2023 /sysroot/run
drwxrwxrwt.  2 root    root    system_u:object_r:root_t:s0         4096 Jul 18  2023 /sysroot/tmp
drwxrwxrwt. 26 root    root    system_u:object_r:tmp_t:s0           620 May  8 14:04 /tmp

$ mount | grep '/run'
composefs on / type overlay (ro,relatime,seclabel,lowerdir+=/run/ostree/.private/cfsroot-lower,datadir+=/sysroot/ostree/repo/objects,redirect_dir=on,metacopy=on)
tmpfs on /run type tmpfs (rw,nosuid,nodev,seclabel,size=11438456k,nr_inodes=819200,mode=755,inode64)
tmpfs on /run/credentials/systemd-journald.service type tmpfs (ro,nosuid,nodev,noexec,relatime,nosymfollow,seclabel,size=1024k,nr_inodes=1024,mode=700,inode64,noswap)
tmpfs on /run/credentials/systemd-resolved.service type tmpfs (ro,nosuid,nodev,noexec,relatime,nosymfollow,seclabel,size=1024k,nr_inodes=1024,mode=700,inode64,noswap)
tmpfs on /run/user/1000 type tmpfs (rw,nosuid,nodev,relatime,seclabel,size=5719224k,nr_inodes=1429806,mode=700,uid=1000,gid=1000,inode64)
gvfsd-fuse on /run/user/1000/gvfs type fuse.gvfsd-fuse (rw,nosuid,nodev,relatime,user_id=1000,group_id=1000)
portal on /run/user/1000/doc type fuse.portal (rw,nosuid,nodev,relatime,user_id=1000,group_id=1000)

Is it possible to set a different tmpdir (that's on the /var/home partition) for each rootless container by creating a containers.conf?

man containers.conf: https://man.archlinux.org/man/containers.conf.5.en :

- /usr/share/containers/containers.conf
- $XDG_CONFIG_HOME/containers/containers.conf
- $XDG_CONFIG_HOME/containers/containers.conf.d/*.conf files
- When $XDG_CONFIG_HOME is not set it falls back to using $HOME/.config instead.

General issues with /tmp dirs - even with rootless containers - is:

• "CWE-400: Uncontrolled Resource Consumption"
  https://cwe.mitre.org/data/definitions/400.html
• /? site:cwe.mitre.org "/tmp"
  https://www.google.com/search?q=site%253Acwe.mitre.org+%22%252Ftmp%22