From 93470c4ea56cdbf8d4599efbc618e86cdded608d Mon Sep 17 00:00:00 2001
From: Josh Hawkins <32435876+hawkeye217@users.noreply.github.com>
Date: Thu, 27 Aug 2026 08:54:48 -0500
Subject: [PATCH] hand /tmp/cache to the runtime user before services start

---
 .github/workflows/ci.yml                              | 5 +++++
 docker/main/rootfs/etc/s6-overlay/s6-rc.d/prepare/run | 7 +++++++
 2 files changed, 12 insertions(+)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index dd208591b5..7977ac09c3 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -68,6 +68,7 @@ jobs:
           docker run -d --name frigate --shm-size 256m \
             -v /tmp/frigate-config:/config \
             -v /tmp/frigate-media:/media/frigate \
+            --mount type=tmpfs,target=/tmp/cache,tmpfs-size=100000000 \
             -p 5000:5000 -p 8971:8971 \
             ${{ steps.setup.outputs.image-name }}-amd64
       - name: Wait for API
@@ -134,6 +135,10 @@ jobs:
           # runtime user can write recordings storage
           docker exec frigate /command/s6-setuidgid frigate touch /media/frigate/.write-probe
           docker exec frigate rm /media/frigate/.write-probe
+          # /tmp/cache is a tmpfs mount here, as the docs recommend: it arrives
+          # root-owned, and the ZMQ IPC sockets live in it
+          docker exec frigate /command/s6-setuidgid frigate touch /tmp/cache/.write-probe
+          docker exec frigate rm /tmp/cache/.write-probe
       - name: Assert escape hatch restores root
         run: |
           mkdir -p /tmp/frigate-config-root
diff --git a/docker/main/rootfs/etc/s6-overlay/s6-rc.d/prepare/run b/docker/main/rootfs/etc/s6-overlay/s6-rc.d/prepare/run
index fc24752631..ad6f717f4c 100755
--- a/docker/main/rootfs/etc/s6-overlay/s6-rc.d/prepare/run
+++ b/docker/main/rootfs/etc/s6-overlay/s6-rc.d/prepare/run
@@ -174,3 +174,10 @@ if [[ "$(id -u)" -eq 0 && ! -d /media/frigate ]]; then
         chown "${PUID:-1000}:${PGID:-1000}" /media/frigate
     fi
 fi
+
+# Usually a tmpfs mount, so it arrives root-owned and is outside the swept
+# volumes. The runtime user binds its ZMQ IPC sockets in here.
+if [[ "$(id -u)" -eq 0 && "${FRIGATE_RUN_AS_ROOT:-false}" != "true" ]]; then
+    mkdir -p /tmp/cache
+    chown "${PUID:-1000}:${PGID:-1000}" /tmp/cache
+fi