diff --git a/internal/service/runner/compile.go b/internal/service/runner/compile.go
index cc97e60..9f53842 100644
--- a/internal/service/runner/compile.go
+++ b/internal/service/runner/compile.go
@@ -68,6 +68,11 @@ func (s *service) Compile(meta *JudgeMeta) (*JudgeStatus, e.Status) {
 					Destination: "/woj/problem/judge",
 					Readonly:    true,
 				},
+				{
+					// Rust will write intermediate files into source directory instead of /tmp
+					Source:      "",
+					Destination: "/woj/user",
+				},
 				{
 					Source:      sourceFile,
 					Destination: fmt.Sprintf("/woj/user/%s.%s", meta.Run.User, meta.Run.Lang),
diff --git a/internal/service/runner/nsjail.go b/internal/service/runner/nsjail.go
index cffe586..cb56d3d 100644
--- a/internal/service/runner/nsjail.go
+++ b/internal/service/runner/nsjail.go
@@ -35,7 +35,10 @@ type MountInfo struct {
 
 func (m *MountInfo) Args() []string {
 	mapping := m.Source + ":" + m.Destination
-	if m.Readonly {
+	if m.Source == "" {
+		// 64MB tmpfs
+		return []string{"-m", "none:" + m.Destination + ":tmpfs:size=67108864"}
+	} else if m.Readonly {
 		return []string{"-R", mapping}
 	} else {
 		return []string{"-B", mapping}
@@ -112,8 +115,9 @@ func (s *service) JailRun(arg *RunArgs) (RuntimeStatus, error) {
 	args := []string{
 		"--quiet",
 		"--use_cgroupv2",
-		"-T", "/tmp",
-		"-E", "PATH=/bin:/sbin:/usr/bin:/usr/sbin:/usr/local/bin:/usr/local/sbin",
+		"--disable_rlimits",                   // Rust requires this
+		"-m", "none:/tmp:tmpfs:size=67108864", // 64MB tmpfs
+		"-E", "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
 		// following envs must sync with resource/runner
 		"-E", "WOJ_LAUNCHER=/woj/framework/scripts/woj_launcher",
 		"-E", "TEMPLATE=/woj/framework/template",
diff --git a/resource/runner/problem/example/judge/custom.Makefile b/resource/runner/problem/example/judge/custom.Makefile
index 03ed373..4bb5145 100644
--- a/resource/runner/problem/example/judge/custom.Makefile
+++ b/resource/runner/problem/example/judge/custom.Makefile
@@ -31,6 +31,7 @@ include ${TEMPLATE}/c.mk ${TEMPLATE}/Judger.mk
 # 						其余通用环境变量，详见 nsjail.go
 
 compile:
+	# /woj/user 目录当且仅当 compile 阶段为 RW
 	$(CC) $(CFLAGS) -o $(PREFIX)/user/$(USER_PROG).out $(PREFIX)/user/$(USER_PROG).$(LANG) $(PREFIX)/problem/judge/gadget.c
 
 judge: