Temporary disks or folders for /run/user/
We've been having an ongoing issue. I am sure its my fault of course, but I wondered if you could point me in the correct direction.
Periodically I will login and run "df -k" to check the disk space. When I do I will often see upwards of 20 tmp disks, that have the form: "/run/user/1234" where 1234 is a random number I don't recognize. Usually, but not always, the disk has 0 free space as a result.
When I reboot the Linode they go away (as I just did), but this keeps happening.
Have you seen this before? Is it likely the Linode is compromised? I can throw it out and start fresh if I have to but would rather not.
/run/user/1234 directories/temporary partitions you are seeing are quite normal in distributions using systemd. This explanation on Stack Exchange is quite concise and also explains why these folders disappear when you reboot:
This directory is local to the system and only accessible by the target user. So applications looking to store their files locally no longer have to worry about access control.
It also keeps things nice and organized. When a user logs out, and no active sessions remain, pam_systemd will wipe the /run/user/$uid directory out.