/images/create endpoint leaks temporary files

[jranieri-grammatech]

Issue Description

The /images/create API endpoint leaks temporary files, prefixed with api_load.tar, when uploading a tar file. CreateImageFromSrc creates a temporary file for this case that it doesn't clean up.

Steps to reproduce the issue

• Start the server with podman system service -t0 unix:///tmp/podman.sock
• Upload an image with curl (any image will do, this command assumes there's a hello.tar):

  curl --unix-socket /tmp/podman.sock \
  -X POST "http://podman/images/create?fromSrc=-&repo=my-image&tag=latest" \
  -H "Content-Type: application/x-tar" \
  --data-binary @hello.tar

• Stop the server with ^C
• Look at the files in /var/tmp:

  ls /var/tmp | grep api_load.tar

Describe the results you received

There is one file per POST to /images/create (when fromSrc is -).

Describe the results you expected

There are no files left over named api_load.tar.

podman info output

host:
  arch: amd64
  buildahVersion: 1.43.0
  cgroupControllers: []
  cgroupManager: cgroupfs
  cgroupVersion: v2
  conmon:
    package: conmon-2.2.1-2.fc42.x86_64
    path: /usr/bin/conmon
    version: 'conmon version 2.2.1, commit: '
  cpuUtilization:
    idlePercent: 99.12
    systemPercent: 0.04
    userPercent: 0.84
  cpus: 24
  databaseBackend: sqlite
  distribution:
    distribution: fedora
    variant: container
    version: "42"
  eventLogger: file
  freeLocks: 2048
  hostname: 08768e1fbcd5
  idMappings:
    gidmap:
    - container_id: 0
      host_id: 0
      size: 1
    - container_id: 1
      host_id: 524288
      size: 65536
    uidmap:
    - container_id: 0
      host_id: 1001
      size: 1
    - container_id: 1
      host_id: 524288
      size: 65536
  kernel: 5.15.0-168-generic
  linkmode: dynamic
  logDriver: k8s-file
  memFree: 1836634112
  memTotal: 33615015936
  networkBackend: netavark
  networkBackendInfo:
    backend: netavark
    defaultNetwork: podman
    dns:
      package: aardvark-dns-1.17.0-1.fc42.x86_64
      path: /usr/libexec/podman/aardvark-dns
      version: aardvark-dns 1.17.0
    package: netavark-1.17.2-1.fc42.x86_64
    path: /usr/libexec/podman/netavark
    version: netavark 1.17.2
  ociRuntime:
    name: crun
    package: crun-1.26-1.fc42.x86_64
    path: /usr/bin/crun
    version: |-
      crun version 1.26
      commit: 3241e671f92c33b0c003cd7de319e4f32add6231
      rundir: /tmp/storage-run-1001/crun
      spec: 1.0.0
      +SYSTEMD +SELINUX +APPARMOR +CAP +SECCOMP +EBPF +CRIU +LIBKRUN +WASM:wasmedge +YAJL
  os: linux
  pasta:
    executable: /usr/sbin/pasta
    package: passt-0^20260120.g386b5f5-1.fc42.x86_64
    version: |
      pasta 0^20260120.g386b5f5-1.fc42.x86_64
      Copyright Red Hat
      GNU General Public License, version 2 or later
        <https://www.gnu.org/licenses/old-licenses/gpl-2.0.html>
      This is free software: you are free to change and redistribute it.
      There is NO WARRANTY, to the extent permitted by law.
  remoteSocket:
    exists: true
    path: /tmp/storage-run-1001/podman/podman.sock
  rootlessNetworkCmd: pasta
  security:
    apparmorEnabled: false
    capabilities: CAP_CHOWN,CAP_DAC_OVERRIDE,CAP_FOWNER,CAP_FSETID,CAP_KILL,CAP_NET_BIND_SERVICE,CAP_SETFCAP,CAP_SETGID,CAP_SETPCAP,CAP_SETUID,CAP_SYS_CHROOT
    rootless: true
    seccompEnabled: true
    seccompProfilePath: /usr/share/containers/seccomp.json
    selinuxEnabled: false
  serviceIsRemote: false
  slirp4netns:
    executable: ""
    package: ""
    version: ""
  swapFree: 0
  swapTotal: 0
  uptime: 1736h 7m 31.00s (Approximately 72.33 days)
  variant: ""
plugins:
  authorization: null
  log:
  - k8s-file
  - none
  - passthrough
  - journald
  network:
  - bridge
  - macvlan
  - ipvlan
  volume:
  - local
registries:
  search:
  - registry.fedoraproject.org
  - registry.access.redhat.com
  - docker.io
store:
  configFile: /home/XXXX/.config/containers/storage.conf
  containerStore:
    number: 0
    paused: 0
    running: 0
    stopped: 0
  graphDriverName: vfs
  graphOptions: {}
  graphRoot: /home/XXXX/.local/share/containers/storage
  graphRootAllocated: 527291383808
  graphRootUsed: 399337218048
  graphStatus: {}
  imageCopyTmpDir: /var/tmp
  imageStore:
    number: 1
  runRoot: /tmp/storage-run-1001/containers
  transientStore: false
  volumePath: /home/XXXX/.local/share/containers/storage/volumes
version:
  APIVersion: 5.8.1
  BuildOrigin: Fedora Project
  Built: 1773187200
  BuiltTime: Wed Mar 11 00:00:00 2026
  GitCommit: c6077f645788743258a1a749f8005b4fb3cbe533
  GoVersion: go1.25.7 X:nodwarf5
  Os: linux
  OsArch: linux/amd64
  Version: 5.8.1

Podman in a container

No

Privileged Or Rootless

None

Upstream Latest Release

No

Additional environment details

No response

Additional information

No response