[alphazard]

I'll take the other side of this. We have this concept of applications being "well behaved" if they only read and write from parts of the filesystem that users expect. The XDG directories are what most linux and macOS users expect, even if they don't know about the standard. This well-behavedness feeds into the larger idea of high quality software. Hiqh quality means users are more likely to recommend it, engineers are more likely to respect the application's authors, etc.

The problem with this is that it's all socially enforced, but it's not a social problem, it's a technical problem. The issue isn't that we haven't put enough pressure on developers to read the correct environment variables. It's that we have such a poor isolation story on UNIX that we have to care about where applications read and write from, rather than letting them do whatever they want in a sandbox.

Many of the open source docker images are on the right track here. Where does the persistent state go? /data. Where does the configuration go? /config. Where does the cached data go? /cache. All in the most obvious places right at the filesystem root. Those applications would be considered "badly behaved" outside the container, but inside, it's much easier to predict what they will do.

[account42]

You can't technically enforce an application to cleanly split cache and configuration data and you will probably already fail to enforce splitting application data and user data for applications that need to access user data.

Technical enforcement is also not free - it has both a performance and usability cost at applies to everyone not just bad actors. One of the things I like about free software is that it allows for high trust environments because you don't need technical restrictions but can instead rely on people not being dicks. I consider this similar to wanting to live in places where I don't have to worry about locking my doors and closing all windows every time I go to the store.

[MawKKe]

Exactly. It feels foolish to demand N unrelated applications implement support for the same arbitrary ruleset N different times.

Why must applications incorporate implementation details of the deployment environment? Why does the environment owner not have tooling to control where files are placed?

[redeeman]

because the application is trusted with a powerful API, that emparts some obligations on whomever wields it not to do bullshit that shouldnt be done.

This trust is in some cases clearly not earned, and so one might consider that some applications are not worthy of having access to these APIs