/tmp is for temporary files, but “temporary” doesn’t clean itself up by magic. Depending on the distribution, /tmp may live in RAM (tmpfs) or on disk, and is cleaned at boot, by age, or not at all. Here’s how it works, and how to clean temp directories safely on a server.

/tmp vs /var/tmp

Directory Intended for Typically
/tmp Short-lived files Cleared at boot and/or after ~10 days
/var/tmp Temp files that should survive reboots Cleared after ~30 days

Check whether /tmp is in RAM:

findmnt /tmp
df -h /tmp

tmpfs means RAM-backed (fast, cleared at every reboot, and limited in size, usually 50% of RAM). Recent Debian releases (13+) and Fedora use tmpfs. Ubuntu keeps /tmp on disk by default.

systemd-tmpfiles: the cleaner

On systemd systems, systemd-tmpfiles applies age-based cleanup rules via the systemd-tmpfiles-clean.timer (daily):

systemctl list-timers | grep tmpfiles
cat /usr/lib/tmpfiles.d/tmp.conf

Typical rules:

q /tmp 1777 root root 10d
q /var/tmp 1777 root root 30d

The last field is the age: files not accessed or modified for that long are deleted. Override it with a file in /etc/tmpfiles.d/:

echo "q /tmp 1777 root root 3d" | sudo tee /etc/tmpfiles.d/tmp.conf
sudo systemd-tmpfiles --clean        # run cleanup now

You can add rules for your own directories too:

# /etc/tmpfiles.d/myapp.conf
d /var/cache/myapp 0750 myapp myapp 7d

(d creates the directory if needed, and cleans contents older than 7 days.)

PrivateTmp: per-service /tmp

Many systemd services run with PrivateTmp=yes: they get their own /tmp, invisible to other processes, and deleted when the service stops. That’s why a file your web app writes to /tmp doesn’t show up when you ls /tmp in your shell. It’s actually under /tmp/systemd-private-*-nginx.service-*/tmp/.

It’s a good security setting. Keep it on, and use a dedicated directory if files must be shared between services.

Safe manual cleanup

Before deleting anything in /tmp, check what’s using it. Running programs may need their files:

sudo du -sh /tmp/* 2>/dev/null | sort -h | tail
sudo lsof +D /tmp 2>/dev/null | head      # open files (can be slow)

Delete old files only:

sudo find /tmp -type f -atime +7 -delete
sudo find /tmp -mindepth 1 -type d -empty -mtime +7 -delete

Avoid rm -rf /tmp/* on a running server: it can break sockets, locks and running jobs (and some desktop environments, on non-servers).

Other “temp” places that fill disks

Location What Cleanup
/var/lib/php/sessions PHP session files PHP’s own garbage collection, or a cron job on Debian/Ubuntu (phpsessionclean)
/var/cache/apt/archives Downloaded packages sudo apt clean
~/.cache User caches (pip, npm, browsers) Safe to clear
App cache dirs WordPress cache plugins, framework caches Use the app’s own clear command
/var/lib/docker Images, build cache docker system prune. See Docker disk cleanup

See disk full troubleshooting and count files in a directory (for directories with millions of small files).

/tmp and security

  • /tmp is world-writable, with the sticky bit (1777): users can create files, but not delete others’ files.
  • Hardening guides mount /tmp with noexec,nosuid,nodev, so attackers can’t run dropped binaries from it. Test your applications afterwards, because some installers execute from /tmp.
  • Malware often hides in /tmp, /var/tmp and /dev/shm. Unexpected executables there are a red flag. See detect a compromised server.

Quick reference

Task Command
Is /tmp in RAM? findmnt /tmp
Cleanup rules /usr/lib/tmpfiles.d/tmp.conf, override in /etc/tmpfiles.d/
Clean now systemd-tmpfiles --clean
Delete old files find /tmp -type f -atime +7 -delete
Biggest items du -sh /tmp/* | sort -h

Related: Linux log files explained and Linux directory structure.

  • Linux
  • systemd
  • Maintenance