What is stored in the /run directory?
/run holds volatile runtime state that only matters while the system is up — PID files, sockets, lock files — and is wiped clean on every reboot.
The defining trait is that it's memory-backed (tmpfs), not on disk, so it's fast and intentionally forgetful. None of this data should survive a reboot, because it all describes the currently running system: which process has which PID, where a daemon's socket is, which lock is held. After a reboot those facts are meaningless, so starting from empty is correct, not a loss.
| Typical contents | Purpose |
|---|---|
/run/user/1000/ |
Per-user runtime data (keyrings, sockets) |
/run/systemd/ |
systemd's live state |
*.pid files |
The process ID of a running service |
/run replaced the older, scattered /var/run and /var/lock, unifying this kind of transient state in one place (the old paths now usually symlink here).
Key insight: a service typically drops a *.pid file in /run when it starts and removes it when it stops — so the presence and contents of that file are a quick way to check whether the service is alive and which process it is.
Mnemonic: data needed while the system is running.