hsh-maxima

since DAC_OVERRIDE is no longer an effective capability, removing
all files from /tmp at startup will no longer work even as root,
since we do not have permissions to delete from other users. this
was always a workarond for kubernetes having problems on OOM related
to overfull emptyDirs.
conveniently, since kubernetes 1.22 setting sizeLimits on memory-
backed emptyDirs is now possible so we can just switch to that since
1.22 should be reasonably widely used by now.