Temporary disks or folders for /run/user/
Linode
Linode Staff
We've been having an ongoing issue. I am sure its my fault of course, but I wondered if you could point me in the correct direction.
Periodically I will login and run "df -k" to check the disk space. When I do I will often see upwards of 20 tmp disks, that have the form: "/run/user/1234" where 1234 is a random number I don't recognize. Usually, but not always, the disk has 0 free space as a result.
When I reboot the Linode they go away (as I just did), but this keeps happening.
Have you seen this before? Is it likely the Linode is compromised? I can throw it out and start fresh if I have to but would rather not.
1 Reply
rmoyer
Linode Staff
The /run/user/1234 directories/temporary partitions you are seeing are quite normal in distributions using systemd. This explanation on Stack Exchange is quite concise and also explains why these folders disappear when you reboot:
This directory is local to the system and only accessible by the target user. So applications looking to store their files locally no longer have to worry about access control.
It also keeps things nice and organized. When a user logs out, and no active sessions remain, pam_systemd will wipe the /run/user/$uid directory out.
While this activity looks to be normal, you may want to check out our post on reviewing suspicious behavior and wondering if I've been compromised.