LGTM

I guess we need to do same for FIFO dir as well (sorry I can't look into deeper during kubecon), but it can be done in separate PR.

I think we need more logic around this because you need to set the sticky bit if you are using this directory. You can see the implementation in runc for how we are using this when userns is enabled:

	root := "/run/runc"
	if os.Geteuid() != 0 {
		runtimeDir := os.Getenv("XDG_RUNTIME_DIR")
		if runtimeDir != "" {
			root = runtimeDir + "/runc"
			// According to the XDG specification, we need to set anything in
			// XDG_RUNTIME_DIR to have a sticky bit if we don't want it to get
			// auto-pruned.
			if err := os.MkdirAll(root, 0700); err != nil {
				fatal(err)
			}
			if err := os.Chmod(root, 0700|os.ModeSticky); err != nil {
				fatal(err)
			}
		}
}

LGTM

After reading the spec again and how we are using it, we are safe without the use of the sticky bit (files modified within last 6hrs or sticky bit). Sorry for the noise.