Q: Your high-frequency fintech service performs intensive cryptographic token generation and session state serialization. Currently, write operations target `/tmp` inside the container writable layer. SREs observe high disk I/O wait (`%iowait`), SSD write wear, and an audit vulnerability: sensitive session tokens written to `/tmp` persist in host storage blocks inside `/var/lib/docker/overlay2`. You must migrate ephemeral data storage to in-memory `tmpfs` mounts, configuring strict size quotas and memory protections.

Writing to a container's default filesystem triggers OverlayFS copy-up operations and flushes dirty pages to physical NVMe storage. `tmpfs` mounts map directly to host kernel RAM and swap, providing microsecond write latency and zero disk persistence upon container stop.

<!-- Storage Comparison -->
Container Write to /tmp (Default):
  Write Syscall ───> OverlayFS copy-up ───> Host Page Cache ───> Physical NVMe Disk (Slow, SSD Wear, Leak Risk)

Container Write to /tmp (tmpfs Mount):
  Write Syscall ───> Kernel VFS RAM Buffer (Sub-microsecond, Zero Disk Touch, Wiped on Exit!)

Configure `docker run` or Docker Compose with `--tmpfs` specifying size limits (`size=512m`) and Unix permissions (`mode=1777`) to prevent rogue processes from consuming all host RAM.

# Docker CLI invocation with strict tmpfs limits
docker run -d \
  --name session-broker \
  --tmpfs /tmp:rw,noexec,nosuid,size=512m,mode=1777 \
  fintech-api:v2.0

# Or using advanced --mount syntax
docker run -d \
  --name secure-crypto \
  --mount type=tmpfs,destination=/app/scratch,tmpfs-size=256M,tmpfs-mode=0700 \
  crypto-engine:latest

Define declarative tmpfs mounts in `compose.yaml` for database scratchpads, Redis temporary working directories, and web server caches.

services:
  redis:
    image: redis:7-alpine
    tmpfs:
      - /data:size=1G,mode=0700
  
  nginx:
    image: nginx:alpine
    tmpfs:
      - /var/cache/nginx:size=256M
      - /var/run:size=10M

Verify that files written to the tmpfs mount exist strictly in RAM and disappear completely when the container is terminated, satisfying PCI-DSS cryptographic storage guidelines.

# Inspect container tmpfs mount
docker exec -it session-broker df -h /tmp
# Output confirms Filesystem: tmpfs, Size: 512M

# Terminate container
docker rm -f session-broker
# Host storage inspection confirms zero traces of session files on physical disk