diff --git a/infra/start.sh b/infra/start.sh
index e3e9bcd..ebb468e 100755
--- a/infra/start.sh
+++ b/infra/start.sh
@@ -68,20 +68,29 @@ _HIY_RUNTIME="/tmp/podman-$(id -u)"
 mkdir -p "$_HIY_RUNTIME"
 export XDG_RUNTIME_DIR="$_HIY_RUNTIME"
 
-# Also write storage.conf so Podman doesn't read a stale RunRoot from the
-# user's existing ~/.config/containers/storage.conf.
+# Write storage.conf and containers.conf so Podman doesn't read stale
+# RunRoot / tmp_dir values from existing user config files.
 mkdir -p "$HOME/.config/containers"
 cat > "$HOME/.config/containers/storage.conf" <<STOCONF
 [storage]
+  driver = "overlay"
   runroot = "$_HIY_RUNTIME/storage"
+  graphroot = "$HOME/.local/share/containers/storage"
 STOCONF
+cat > "$HOME/.config/containers/containers.conf" <<CCONF
+[engine]
+  tmp_dir = "$_HIY_RUNTIME"
+CCONF
 
 PODMAN_SOCK="${_HIY_RUNTIME}/podman.sock"
 export PODMAN_SOCK
 export DOCKER_HOST="unix://${PODMAN_SOCK}"
 if [ ! -S "$PODMAN_SOCK" ]; then
     echo "[hiy] Starting Podman socket via podman system service…"
-    podman system service --time=0 "unix://${PODMAN_SOCK}" &
+    # Use env to guarantee XDG_RUNTIME_DIR is correct even if the calling
+    # shell environment has it set to a non-writable path.
+    env XDG_RUNTIME_DIR="$_HIY_RUNTIME" \
+        podman system service --time=0 "unix://${PODMAN_SOCK}" &
     # Wait up to 5 s for the socket to appear
     for i in 1 2 3 4 5; do
         [ -S "$PODMAN_SOCK" ] && break