Textbook of Linux

/run is a tmpfs-backed directory, mounted early in the boot process, that holds volatile runtime data produced by system services. PID files, Unix sockets, D-Bus sockets, mount state, and other transient information live here. Because it is tmpfs, it vanishes at shutdown and is recreated empty at boot, which neatly solves the old problem of stale PID and lock files from the previous run.

Historically, such data lived under /var/run/ and /var/lock/. But those directories were created before early-boot tmpfs was available, so they could hold stale files across reboots. The move to /run was led by systemd and Fedora around 2011 and has since been adopted almost universally; /var/run is now typically a symlink to /run, and /var/lock to /run/lock.

Examples include /run/systemd/ (systemd's state), /run/user/1000/ (per-user runtime directory, holding the user's D-Bus socket and WAYLAND_DISPLAY), /run/lock/ (lock files), and package-specific directories like /run/mysqld/mysqld.sock. Because /run/user/$UID is cleaned up on logout, it is an ideal place for short-lived user sockets and state.