tempfile

tempfile is a battle-tested Rust crate for creating temporary files and directories that are automatically removed when they are no longer referenced. It handles the surprisingly hard parts of temporary storage securely and portably: unpredictable random file names, private-by-default permissions, and reliable cleanup via RAII destructors or the operating system itself.

Beyond simple scratch files, the library lets you open multiple independent handles to the same unnamed temporary file, name temporary files so they can be passed to other processes by path, and spool data in memory until it grows large enough to warrant spilling to disk. It supports every major platform, from Linux, macOS, and Windows to the BSDs, Illumos, Redox, and WASI.

What You Get

• Unnamed temporary files via tempfile() that the OS removes once the last handle closes, with no reliance on destructors running.
• NamedTempFile and TempDir types with RAII cleanup, plus a Builder for customizing prefix, suffix, randomness, permissions, and directory.
• A spooled_tempfile() buffer that stays in memory until it exceeds a threshold, then transparently spills to a real temporary file.
• Secure defaults: private file permissions, 6 random characters per name, and re-seeding from system randomness after repeated collisions.
• Broad platform coverage including Linux, macOS, Windows, the BSDs, Illumos, Redox, and WASI.

Common Use Cases

• Buffering large or streamed data to disk during processing without leaking files.
• Providing isolated scratch directories for test fixtures that are torn down automatically.
• Writing a file atomically by staging it in a temporary location and persisting it into place on success.

Under The Hood

Architecture — The public surface in src/lib.rs (a Builder plus free functions like tempfile(), tempdir(), and spooled_tempfile()) delegates to a shared name-generation and retry core in src/util.rs, whose create_helper forks a fastrand RNG, builds absolute paths, and retries on AlreadyExists/AddrInUse collisions. Platform behavior is isolated behind per-OS implementation modules under src/file/imp/ (unix.rs, windows.rs, other.rs) and src/dir/imp/, so the cross-cutting logic stays platform-agnostic while syscalls live in cfg-gated backends.

Tech Stack — Pure Rust (edition 2021, MSRV 1.63) with a deliberately minimal dependency set: fastrand for fast name randomness, once_cell for lazily-initialized globals, rustix for Unix/WASI filesystem syscalls, windows-sys for the Win32 storage APIs, and an optional getrandom (default-enabled) for secure RNG re-seeding. Version bounds are kept wide to preserve compatibility with Debian-stable toolchains.

Code Quality — The crate is mature and thoroughly tested, with a dedicated integration suite in tests/ covering tempfile, namedtempfile, tempdir, spooled, and env behaviors. Error handling is careful and explicit — collision kinds are matched precisely, paths are attached to errors via an IoResultExt helper, and security-sensitive decisions (re-seeding after three failures, absolute-path normalization) are documented inline. Naming is idiomatic and the module boundaries are clean.

API Design — The developer experience is excellent: one-line helpers cover the common cases while a fluent Builder exposes prefix, suffix, rand_bytes, permissions, append, and directory controls for the rest. Extensive rustdoc with runnable examples, a documented security model, and an explicit callout of the early-drop pitfall make the API both ergonomic and hard to misuse.