e.g. were we deploying apache, as root you’d mkdir /var/lib/apache or whatever and use that - not sure as a user there’s a known arbitrarily writable path in /var other than /var/tmp