Temporary Files in Linux

• Documentation/filesystems/tmpfs.rst (kernel docs)

• man open, openat, linkat, lsof

Temporary files in Linux are ordinary files used for caching, buffering, or holding intermediate data. Examples include storing data while sorting large datasets, temporarily holding the contents of files being zipped or unzipped, or keeping partially-downloaded files until a transfer completes successfully. Many applications rely on temporary files for scratch space, ensuring that incomplete or temporary data stays behind the scenes and never shows up for the user.

Linux 中的临时文件本质上是普通文件，用于缓存、缓冲或承载中间数据。例如：在对大规模数据集进行排序时暂存数据；在压缩或解压缩过程中临时保存文件内容；或在传输完成前保留部分下载的文件。许多应用依赖临时文件作为“工作区”（scratch space），以确保未完成或仅用于过渡的数据保持在幕后，不会直接呈现给用户。

There is no special “temporary file” type baked into the virtual filesystem layer (VFS), “temporary” is a convention implemented by software. That said, two mechanisms are commonly used to achieve this:

在虚拟文件系统层（VFS）中，并不存在一种内建的“临时文件”专用类型；“临时”更多是一种由软件约定与实现的语义。然而，在实践中通常有两种常用机制用以达成“临时性”目标：

• tmpfs: a memory-backed filesystem (with optional swap backing) typically mounted at /run or /dev/shm.

  tmpfs：一种以内存为后端的文件系统（可选地以 swap 作为后备），通常挂载于 `/run` 或 `/dev/shm`。

• O_TMPFILE: a flag to open(2)/openat(2) that creates an unnamed file on a regular on-disk filesystem (e.g., XFS, ext4). The file starts with no directory entry and exists only by file descriptor, it can later be linked into the namespace atomically.

  O_TMPFILE：`open(2)`/`openat(2)` 的一个标志位，用于在常规磁盘文件系统（如 XFS、ext4）上创建“无名文件”。该文件初始不具有目录项，仅通过文件描述符存在；随后可通过原子方式将其链接（link）进文件系统命名空间。

This article explains each mechanism, details their creation–utilization–deletion lifecycle, and shows how to tell them apart. It also uses XFS filesystem to showcase the O_TMPFILE flag.

本文将分别解释上述两种机制，详述其“创建—使用—删除”的生命周期，并展示如何区分它们。同时，本文还以 XFS 文件系统为例演示 `O_TMPFILE` 标志的用法。

tmpfs

tmpfs is a RAM-backed filesystem that allows users to create and use files just like in any traditional directory, but the data is stored in volatile memory rather than on a physical disk. Popular mount points for tmpfs include /dev/shm and /run, depending on how the system is set up. Since tmpfs is managed by the kernel’s VFS layer, working with files and directories in tmpfs is as seamless as anywhere else. Creating, reading, and writing files uses all the familiar commands and APIs.

tmpfs 是一种以 RAM 为后端的文件系统，用户可像在传统目录中一样创建与使用文件，但其数据存放于易失性内存而非物理磁盘。常见的 tmpfs 挂载点包括 `/dev/shm` 与 `/run`，具体取决于系统配置。由于 tmpfs 由内核 VFS 层管理，因此在 tmpfs 中操作文件与目录与在其他文件系统中同样自然、无缝；文件的创建、读取与写入仍使用熟悉的命令与 API。

Setting up a tmpfs mount is straightforward. Many distributions automatically mount /dev/shm, but additional tmpfs partitions can be mounted as needed. For example:

配置 tmpfs 挂载点相对直接。许多发行版会自动挂载 `/dev/shm`，但也可以按需挂载额外的 tmpfs 分区。例如：

sudo mount -t tmpfs -o size=2G tmpfs /mnt/tmp_fs  

This creates a 2GB in-memory filesystem at /mnt/tmp_fs.

这将在 `/mnt/tmp_fs` 创建一个容量上限为 2GB 的内存文件系统。

Once mounted, files on tmpfs are accessed as usual:

挂载完成后，即可按常规方式访问 tmpfs 上的文件：

echo "hello world" > /mnt/tmp_fs/hello.txt  dd if=/dev/zero of=/mnt/tmp_fs/bigfile bs=1M count=100  

Behind the scenes, writing to tmpfs allocates anonymous memory pages, which live in system RAM. Setting a maximum size with the size mount option ensures the filesystem does not grow beyond the defined limit, which helps with resource management on busy systems. If no limit is specified, tmpfs may use up to half of the total available memory by default, plus swap if enabled. Because tmpfs storage directly consumes memory, writing large files to tmpfs will reduce the amount of free and available memory on the system. This can quickly lead to memory pressure, causing the system to slow down as it resorts to swapping.

在实现层面，向 tmpfs 写入数据会分配匿名内存页（anonymous pages），这些页驻留于系统 RAM。通过挂载参数 `size` 设定上限，可确保文件系统不会增长到超过预定义限制，从而有助于在繁忙系统中进行资源治理。若不指定限制，tmpfs 默认可能使用最多约一半的可用内存，并在启用 swap 时进一步借助 swap。由于 tmpfs 存储直接消耗内存，向 tmpfs 写入大文件会降低系统可用与空闲内存，可能迅速引发内存压力，进而促使系统因依赖交换而变慢。

It’s worth noting that Linux offers another in-memory filesystem called ramfs. It works in a similar way, keeping files in memory. But unlike tmpfs, ramfs doesn’t let you set size limits or use swap. This means if too much is written to ramfs, it can keep growing and end up using all your system memory. That’s why tmpfs is usually the safer choice for most tasks, it gives you a way to keep memory usage under control.

值得注意的是，Linux 还提供另一种内存文件系统 `ramfs`。其工作方式与 tmpfs 类似，同样将文件保存在内存中；但与 tmpfs 不同，`ramfs` 不支持设置大小上限，也不使用 swap。由此，若写入过多数据，`ramfs` 可能持续增长并最终耗尽全部系统内存。因此，在多数任务中 tmpfs 通常更安全，因为它提供了控制内存使用的手段。

Since tmpfs is a memory-backed filesystem and not associated with a physical block device, tools like blkid and lsblk do not display tmpfs mounts. Usage and mount details for tmpfs can be checked using the df and mount commands instead.

由于 tmpfs 以内存为后端且不对应物理块设备，`blkid` 与 `lsblk` 等工具不会显示 tmpfs 挂载信息。相应地，可使用 `df` 与 `mount` 命令查看 tmpfs 的用量与挂载细节。

# mount | grep tmpfs  tmpfs on /mnt/tmp_fs type tmpfs (rw,relatime,seclabel,size=2097152k)  # df -hT /mnt/tmp_fs/  Filesystem     Type   Size  Used Avail Use% Mounted on  tmpfs          tmpfs  2.0G  2.3M  2.0G   1% /mnt/tmp_fs  

Here is an example showing the memory stats before and after creating a large file on tmpfs.

下面给出一个示例，展示在 tmpfs 上创建大文件前后的内存统计差异。

$ cat /proc/meminfo | grep -E 'Mem|anon'  MemTotal:       16092496 kB  MemFree:        11905188 kB  MemAvailable:   14553688 kB  Active(anon):     899632 kB  Inactive(anon):    15264 kB  

After running the command dd if=/dev/zero of=/mnt/tmp_fs/bigfile bs=1M count=1024 we can see the memory consumption details below.

执行 `dd if=/dev/zero of=/mnt/tmp_fs/bigfile bs=1M count=1024` 后，可观察到如下内存消耗变化：

$ cat /proc/meminfo | grep -E 'Mem|anon'  MemTotal:       16092496 kB  MemFree:        10839752 kB  MemAvailable:   13493648 kB  Active(anon):     908424 kB  Inactive(anon):  1063840 kB  

As shown in the example, writing large files to tmpfs directly increases the amount of memory used for anonymous pages. Specifically, this is reflected as a rise in Inactive(anon) in /proc/meminfo.

如示例所示，向 tmpfs 写入大文件会直接增加匿名页所占用的内存；这在 `/proc/meminfo` 中具体体现为 `Inactive(anon)` 的上升。

A key property of tmpfs is its volatility. Since data lives in memory, contents disappear when the filesystem is unmounted or the machine is rebooted. Additionally, tmpfs is swap-aware. Under memory pressure, the kernel may move some tmpfs pages to swap, freeing up physical RAM at the cost of slower access. So, there’s no risk of processes monopolizing RAM through tmpfs alone.

tmpfs 的关键特性之一是“易失性”：数据驻留内存，因此在卸载文件系统或机器重启时内容将消失。此外，tmpfs 具备 swap 感知能力；在内存压力下，内核可能将部分 tmpfs 页面换出到 swap，以牺牲访问速度为代价释放物理 RAM。因此，仅凭 tmpfs 本身并不会必然导致进程“永久独占”RAM（尽管不当使用仍可造成显著压力）。

Files are removed in tmpfs the same way as on disk: when a file is unlinked (deleted), it is removed from the directory structure, and the memory it used is only freed once no process has it open. Unmounting the tmpfs filesystem erases all of its files immediately, so be sure to copy any important data to persistent storage if required.

tmpfs 中的文件删除语义与磁盘文件系统相同：当文件被解除链接（unlink，即删除）时，它会从目录结构中移除；但其占用的内存仅在没有任何进程仍保持打开该文件的情况下才会被释放。卸载 tmpfs 文件系统会立即清空其中所有文件，因此若其中包含重要数据，应在卸载前复制到持久化存储。

In summary, tmpfs is invaluable for scenarios requiring fast, temporary storage that won’t survive a reboot. Ideal for caches or holding intermediate data. The typical lifecycle of a tmpfs file is:

总而言之，tmpfs 对于需要高速、临时且不要求跨重启持久保存的存储场景极具价值，尤其适用于缓存或中间数据的承载。tmpfs 文件的典型生命周期如下：

• Mounts tmpfs (or use a pre-existing mount like /dev/shm).

  挂载 tmpfs（或使用诸如 `/dev/shm` 的既有挂载点）。

• Applications create and use files in this space, taking advantage of RAM-speed I/O.

  应用在该空间中创建与使用文件，利用 RAM 级 I/O 速度。

• As system memory fills, tmpfs contents may be swapped.

  随系统内存趋于紧张，tmpfs 内容可能被换出到 swap。

• Files are deleted when no longer needed, and on unmount or reboot everything is wiped clean.

  文件在不再需要时被删除；在卸载或重启时，所有内容被清空。

O_TMPFILE

While tmpfs provides an in-memory, temporary store for files that should disappear upon reboot or unmount, Linux also offers a powerful feature at the filesystem level for managing truly transient files: the O_TMPFILE flag.

尽管 tmpfs 为“重启或卸载即消失”的文件提供了内存型临时存储，Linux 还在文件系统层面提供了一项用于管理真正瞬态文件的强大能力：`O_TMPFILE` 标志。

Opening a file descriptor with O_TMPFILE instructs the kernel to create an unnamed file that has no visible directory entry. This file physically exists on the filesystem, but remains invisible to all users and processes. The only reference to it is the file descriptor within the process. As a result, even if other processes want to look for it by name, they cannot. Until the file is explicitly made visible, it doesn’t appear anywhere in the filesystem’s directory tree.

以 `O_TMPFILE` 打开文件描述符会指示内核创建一个无名文件，该文件不具有可见目录项。它在文件系统中物理存在，但对所有用户与进程均不可见；对它的唯一引用是进程内部的文件描述符。因此，即便其他进程试图通过文件名查找，也无法找到它。在显式将其变为可见之前，该文件不会出现在文件系统的目录树中。

The lifecycle of an O_TMPFILE file is closely tied to its file descriptor. As long as at least one file descriptor remains open, the kernel keeps the file alive. If all file descriptors referencing the file are closed and the file has not been linked into the filesystem, the kernel automatically deletes it, making this mechanism perfect for temporary, staging, or scratch files that don’t need persistence or visibility.

`O_TMPFILE` 文件的生命周期与其文件描述符紧密绑定：只要至少存在一个打开的文件描述符，内核就会保持该文件存活；若所有引用该文件的描述符均被关闭，且该文件尚未被链接进文件系统命名空间，则内核会自动删除它。这使得该机制非常适合用于不需要持久性或可见性的临时文件、暂存文件或工作文件。

The feature truly shines when you want to avoid filename collisions or exposure of incomplete files. 

For example, application data can be written to an O_TMPFILE file, validate everything, and only then make it visible with an atomic system call like linkat(2). 

An unlinked file is similar to a file opened with O_TMPFILE, in the sense that both result in a file present on disk with an inode but without an associated directory entry, and both consume space in the filesystem that cannot be found using du tools.

However, use tools like lsof to list all files currently open by a process including temporary or unlinked files, even though they do not appear in the filesystem’s directory structure.

当需要避免文件名冲突或防止未完成文件暴露时，该特性尤为突出。例如，应用可先将数据写入 `O_TMPFILE` 文件，完成校验后再通过 `linkat(2)` 等原子系统调用使其变为可见。解除链接（unlinked）的文件在某种意义上类似于以 `O_TMPFILE` 打开的文件：两者都会在磁盘上留下具有 inode 但无目录项的文件对象，并占用文件系统空间，而 `du` 等基于目录遍历的工具难以发现它们。不过，可以使用 `lsof` 等工具列出进程当前打开的所有文件，包括临时或已解除链接的文件，即便它们并未出现在文件系统目录结构中。

Why is O_TMPFILE useful?

• Prevents race conditions and name clashes

  可防止竞争条件与名称冲突。

• Keeps potentially incomplete or sensitive data invisible until ready.

  在数据尚未就绪时保持其不可见，从而避免暴露不完整或敏感内容。

• Enables atomic publish of the final file. Once linkat() is called, the file appears under a visible path.

  支持最终文件的原子发布：一旦调用 `linkat()`，文件即以可见路径出现。

Example

/* LICENSE: GPLv2 */#define _GNU_SOURCE#include <fcntl.h>#include <unistd.h>#include <stdio.h>#include <string.h>#include <errno.h>intmain() {    int fd = open("/mnt/xfs", O_TMPFILE | O_RDWR, 0600);    if (fd < 0) {        perror("open(O_TMPFILE)");        return 1;    }    const char *msg = "O_TMPFILE with XFS!\n";    if (write(fd, msg, strlen(msg)) < 0) {        perror("write");        close(fd);        return 1;    }    /*    // Uncomment to link the file     // Link the file into the namespace to make the file visible    if (linkat(fd, "", AT_FDCWD, "/mnt/xfs/published.txt", AT_EMPTY_PATH) < 0) {        perror("linkat");        close(fd);        return 1;    }    */    close(fd); // If never linked, file is deleted on close    return 0;}</errno.h></string.h></stdio.h></unistd.h></fcntl.h>

In the example above, the linkat call with an empty string ("") for the old name and the AT_EMPTY_PATH flag tells the kernel to use the tmp file’s file descriptor as the source. This makes the previously unnamed temporary file visible in the filesystem at /mnt/xfs/published.txt. Without this step, the file would be automatically deleted when closed. For more information about the linkat system call and its flags, see man 2 linkat.

在上述示例中，`linkat` 调用将旧名称参数设置为空字符串（`""`），并配合 `AT_EMPTY_PATH` 标志，指示内核以该临时文件的文件描述符作为“源”。这会使此前无名的临时文件在文件系统中以 `/mnt/xfs/published.txt` 的路径变为可见。若不执行该步骤，则该文件会在关闭时被自动删除。有关 `linkat` 系统调用及其标志的更多信息，可参阅 `man 2 linkat`。

Conclusion

tmpfs is useful when applications need fast, non-persistent storage such as caches or temporary working files that will be lost on unmount or reboot. It stores data in RAM, making file access speedy but temporary.

当应用需要快速但不要求持久保存的存储（如缓存或会在卸载/重启时消失的临时工作文件）时，tmpfs 十分适用。它将数据存储在 RAM 中，从而提供高速访问，但其内容具有临时性。

O_TMPFILE is a feature for securely creating unnamed temporary files on filesystems. It prevents filename clashes and ensures incomplete data remains hidden until explicitly linked. This is helpful for atomic file updates and for keeping scratch files private to a process.

`O_TMPFILE` 则用于在文件系统上安全地创建无名临时文件：它避免文件名冲突，并保证未完成数据在显式链接之前保持隐藏。这对于原子化文件更新以及将工作文件限制为进程私有尤为有益。

tmpfs is best suited for applications requiring temporary, RAM-backed storage that can be accessed like any normal file. Use O_TMPFILE for transient files that should remain invisible until fully prepared, particularly in scenarios where reliable, race-free file creation and updates are needed.

总体而言，tmpfs 最适用于需要“可像普通文件一样访问”的 RAM 后端临时存储场景；而 `O_TMPFILE` 适用于那些在完全准备就绪前应保持不可见的瞬态文件，尤其是在需要可靠、无竞争的文件创建与更新的场景中。