Temp Files & Atomic Writes

The problem: in-place writes aren’t atomic

The obvious way to update a file —

os.WriteFile("config.json", data, 0o644) // truncates, then writes

— is dangerous for anything you care about. WriteFile truncates the file and then writes the bytes. If the process crashes, the machine loses power, or someone sends SIGKILL between those steps, you’re left with a truncated or half-written file, and the previous good contents are already gone. Config files, caches, saved state, databases — all need better.

The pattern: write to temp, then rename

The fix relies on one guarantee: rename() is atomic within a filesystem. So:

graph LR
W["write full contents<br/>to temp file"] --> S["(optional) fsync<br/>temp file"]
S --> R["rename temp → target<br/>(atomic swap)"]
R --> DONE["readers see old OR new,<br/>never partial"]

This runs on the playground — it writes a temp file in the same directory, then renames it over the target, and proves the result is intact:

package main

import (
"fmt"
"os"
"path/filepath"
)

// atomicWrite writes data to path crash-safely: temp file + rename.
func atomicWrite(path string, data []byte, perm os.FileMode) error {
dir := filepath.Dir(path)
// Temp file in the SAME directory → same filesystem → atomic rename.
tmp, err := os.CreateTemp(dir, ".tmp-*")
if err != nil {
	return err
}
tmpName := tmp.Name()
defer os.Remove(tmpName) // clean up if we bail out before rename

if _, err := tmp.Write(data); err != nil {
	tmp.Close()
	return err
}
if err := tmp.Sync(); err != nil { // flush to disk for durability
	tmp.Close()
	return err
}
if err := tmp.Close(); err != nil {
	return err
}
if err := os.Chmod(tmpName, perm); err != nil {
	return err
}
return os.Rename(tmpName, path) // the atomic swap
}

func main() {
dir, _ := os.MkdirTemp("", "atomic")
defer os.RemoveAll(dir)
path := filepath.Join(dir, "config.json")

os.WriteFile(path, []byte("{\"v\":1}"), 0o644) // an existing good file

if err := atomicWrite(path, []byte("{\"v\":2}"), 0o644); err != nil {
	fmt.Println("error:", err)
	return
}

got, _ := os.ReadFile(path)
fmt.Printf("file is intact: %s\n", got) // {"v":2}
}

Even if the program died right after CreateTemp or mid-Write, config.json would still hold the old {"v":1} — the rename only happens once the new file is complete.

Temp files and directories

Go gives you race-free temp creation:

• os.CreateTemp(dir, pattern) — creates and opens a uniquely-named file (* in the pattern becomes random chars). Pass "" for the OS temp dir, or the target’s dir for atomic rename.
• os.MkdirTemp(dir, pattern) — a uniquely-named temp directory; pair with defer os.RemoveAll(dir).
• os.TempDir() — the system temp location ($TMPDIR or /tmp).

f, _ := os.CreateTemp("", "report-*.csv") // /tmp/report-3f9a1.csv
defer os.Remove(f.Name())
defer f.Close()

Durability: where fsync fits

rename guarantees ordering (no torn file), but bytes may still sit in the OS page cache when power is lost. For true crash durability:

1. tmp.Sync() — flush the temp file’s data to stable storage before the rename.
2. After the rename, fsync the directory so the rename entry itself is persisted.

Most applications stop at the atomic rename (step 1 optional). Databases and anything that must survive a yanked power cord do all of it.

See also

• files & directories — reading, walking, and metadata.
• signals — why a write can be interrupted, and graceful shutdown.
• files & the os package (stdlib) — the broader file API.
• system calls — the rename/fsync calls underneath.

Next: programs that launch and manage other programs — processes & exec.

Related topics