diff --git a/.make/release.mk b/.make/release.mk
index 376b1a8440..65892559a5 100644
--- a/.make/release.mk
+++ b/.make/release.mk
@@ -13,8 +13,10 @@ release-dirs:
 release-linux: $(GOX) release-dirs
 	$(GOX) -tags 'netgo $(TAGS)' -ldflags '-extldflags "-static" $(LDFLAGS)' -os 'linux' -arch 'amd64 386 arm64 arm' -output '$(DIST)/binaries/$(EXECUTABLE)-$(OUTPUT)-{{.OS}}-{{.Arch}}' ./cmd/$(NAME)
 
+# docker specific packaging flags
+DOCKER_LDFLAGS += -X "$(OCIS_REPO)/ocis-pkg/config/defaults.BaseDataPathType=path" -X "$(OCIS_REPO)/ocis-pkg/config/defaults.BaseDataPathValue=/var/lib/ocis"
 release-linux-docker: $(GOX) release-dirs
-	$(GOX) -tags 'netgo $(TAGS)' -ldflags '-extldflags "-static" $(LDFLAGS)' -os 'linux' -arch 'amd64 386 arm64 arm' -output '$(DIST)/binaries/$(EXECUTABLE)-{{.OS}}-{{.Arch}}' ./cmd/$(NAME)
+	$(GOX) -tags 'netgo $(TAGS)' -ldflags '-extldflags "-static" $(LDFLAGS) $(DOCKER_LDFLAGS)' -os 'linux' -arch 'amd64 386 arm64 arm' -output '$(DIST)/binaries/$(EXECUTABLE)-{{.OS}}-{{.Arch}}' ./cmd/$(NAME)
 
 .PHONY: release-windows
 release-windows: $(GOX) release-dirs
diff --git a/accounts/pkg/config/config.go b/accounts/pkg/config/config.go
index c63c289f7e..0afc8e094c 100644
--- a/accounts/pkg/config/config.go
+++ b/accounts/pkg/config/config.go
@@ -68,8 +68,9 @@ type Log struct {
 
 // Repo defines which storage implementation is to be used.
 type Repo struct {
-	Disk Disk
-	CS3  CS3
+	Backend string
+	Disk    Disk
+	CS3     CS3
 }
 
 // Disk is the local disk implementation of the storage.
diff --git a/accounts/pkg/flagset/flagset.go b/accounts/pkg/flagset/flagset.go
index 3b99a9293a..4c6224a975 100644
--- a/accounts/pkg/flagset/flagset.go
+++ b/accounts/pkg/flagset/flagset.go
@@ -1,8 +1,11 @@
 package flagset
 
 import (
+	"path"
+
 	"github.com/owncloud/ocis/accounts/pkg/config"
 	accounts "github.com/owncloud/ocis/accounts/pkg/proto/v0"
+	"github.com/owncloud/ocis/ocis-pkg/config/defaults"
 	"github.com/owncloud/ocis/ocis-pkg/flags"
 	"github.com/urfave/cli/v2"
 )
@@ -155,10 +158,17 @@ func ServerWithConfig(cfg *config.Config) []cli.Flag {
 			EnvVars:     []string{"ACCOUNTS_JWT_SECRET", "OCIS_JWT_SECRET"},
 			Destination: &cfg.TokenManager.JWTSecret,
 		},
+		&cli.StringFlag{
+			Name:        "storage-backend",
+			Value:       flags.OverrideDefaultString(cfg.Repo.Disk.Path, "CS3"),
+			Usage:       "Which backend to use to store accounts data (CS3 or disk)",
+			EnvVars:     []string{"ACCOUNTS_STORAGE_BACKEND"},
+			Destination: &cfg.Repo.Backend,
+		},
 		&cli.StringFlag{
 			Name:        "storage-disk-path",
-			Value:       flags.OverrideDefaultString(cfg.Repo.Disk.Path, ""),
-			Usage:       "Path on the local disk, e.g. /var/tmp/ocis/accounts",
+			Value:       flags.OverrideDefaultString(cfg.Repo.Disk.Path, path.Join(defaults.BaseDataPath(), "accounts")),
+			Usage:       "Path on the local disk to store accounts data when backend is set to disk",
 			EnvVars:     []string{"ACCOUNTS_STORAGE_DISK_PATH"},
 			Destination: &cfg.Repo.Disk.Path,
 		},
diff --git a/accounts/pkg/proto/v0/accounts.pb.micro_test.go b/accounts/pkg/proto/v0/accounts.pb.micro_test.go
index 96021a8790..fa2ec37580 100644
--- a/accounts/pkg/proto/v0/accounts.pb.micro_test.go
+++ b/accounts/pkg/proto/v0/accounts.pb.micro_test.go
@@ -392,7 +392,7 @@ func deleteGroup(t *testing.T, id string) (*empty.Empty, error) {
 
 // createTmpDir creates a temporary dir for tests data.
 func createTmpDir() string {
-	name, err := ioutil.TempDir("/var/tmp", "ocis-accounts-store-")
+	name, err := ioutil.TempDir("/tmp", "ocis-accounts-store-")
 	if err != nil {
 		panic(err)
 	}
diff --git a/accounts/pkg/service/v0/accounts_permission_test.go b/accounts/pkg/service/v0/accounts_permission_test.go
index 3fdc5885f4..6ebe751404 100644
--- a/accounts/pkg/service/v0/accounts_permission_test.go
+++ b/accounts/pkg/service/v0/accounts_permission_test.go
@@ -23,7 +23,7 @@ import (
 	"go-micro.dev/v4/metadata"
 )
 
-const dataPath = "/var/tmp/ocis-accounts-tests"
+const dataPath = "/tmp/ocis-accounts-tests"
 
 var (
 	roleServiceMock settings.RoleService
diff --git a/accounts/pkg/service/v0/service.go b/accounts/pkg/service/v0/service.go
index ff6059f143..ffedcb5f6e 100644
--- a/accounts/pkg/service/v0/service.go
+++ b/accounts/pkg/service/v0/service.go
@@ -58,7 +58,7 @@ func New(opts ...Option) (s *Service, err error) {
 	}
 
 	r := oreg.GetRegistry()
-	if cfg.Repo.Disk.Path == "" {
+	if strings.ToLower(cfg.Repo.Backend) != "disk" {
 		if _, err := r.GetService("com.owncloud.storage.metadata"); err != nil {
 			logger.Error().Err(err).Msg("index: storage-metadata service not present")
 			return nil, err
diff --git a/deployments/examples/cs3_users_ocis/docker-compose.yml b/deployments/examples/cs3_users_ocis/docker-compose.yml
index d296e8a01f..2ace7668e2 100644
--- a/deployments/examples/cs3_users_ocis/docker-compose.yml
+++ b/deployments/examples/cs3_users_ocis/docker-compose.yml
@@ -89,7 +89,7 @@ services:
       - ./config/ocis/entrypoint-override.sh:/entrypoint-override.sh
       - ./config/ocis/web-config.dist.json:/config/web-config.dist.json
       - ./config/ocis/proxy-config.json:/config/proxy-config.json
-      - ocis-data:/var/tmp/ocis
+      - ocis-data:/var/lib/ocis
     labels:
       - "traefik.enable=true"
       - "traefik.http.routers.ocis.entrypoints=https"
diff --git a/deployments/examples/oc10_ocis_parallel/docker-compose.yml b/deployments/examples/oc10_ocis_parallel/docker-compose.yml
index 0440ac4259..24df273a34 100644
--- a/deployments/examples/oc10_ocis_parallel/docker-compose.yml
+++ b/deployments/examples/oc10_ocis_parallel/docker-compose.yml
@@ -119,7 +119,7 @@ services:
     volumes:
       - ./config/ocis/entrypoint-override.sh:/entrypoint-override.sh
       - ./config/ocis/proxy-config.dist.json:/config/proxy-config.dist.json
-      - ocis-data:/var/tmp/ocis
+      - ocis-data:/var/lib/ocis
       # shared volume with oC10
       - oc10-data:/mnt/data
     labels:
diff --git a/deployments/examples/ocis_hello/docker-compose.yml b/deployments/examples/ocis_hello/docker-compose.yml
index 82d2a8728d..a9f050ea5d 100644
--- a/deployments/examples/ocis_hello/docker-compose.yml
+++ b/deployments/examples/ocis_hello/docker-compose.yml
@@ -69,7 +69,7 @@ services:
       - ./config/ocis/entrypoint-override.sh:/entrypoint-override.sh
       - ./config/ocis/web-config.dist.json:/config/web-config.dist.json
       - ./config/ocis/proxy-config.json:/config/proxy-config.json
-      - ocis-data:/var/tmp/ocis
+      - ocis-data:/var/lib/ocis
     labels:
       - "traefik.enable=true"
       - "traefik.http.routers.ocis.entrypoints=https"
diff --git a/deployments/examples/ocis_keycloak/docker-compose.yml b/deployments/examples/ocis_keycloak/docker-compose.yml
index a98dcd3cba..00301fa35d 100644
--- a/deployments/examples/ocis_keycloak/docker-compose.yml
+++ b/deployments/examples/ocis_keycloak/docker-compose.yml
@@ -73,7 +73,7 @@ services:
       OCIS_MACHINE_AUTH_API_KEY: ${OCIS_MACHINE_AUTH_API_KEY:-change-me-please}
     volumes:
       - ./config/ocis/entrypoint-override.sh:/entrypoint-override.sh
-      - ocis-data:/var/tmp/ocis
+      - ocis-data:/var/lib/ocis
     labels:
       - "traefik.enable=true"
       - "traefik.http.routers.ocis.entrypoints=https"
diff --git a/deployments/examples/ocis_s3/docker-compose.yml b/deployments/examples/ocis_s3/docker-compose.yml
index 2964a58864..51b3a7c553 100644
--- a/deployments/examples/ocis_s3/docker-compose.yml
+++ b/deployments/examples/ocis_s3/docker-compose.yml
@@ -72,7 +72,7 @@ services:
       STORAGE_USERS_DRIVER_S3NG_BUCKET: ${MINIO_BUCKET:-ocis-bucket}
     volumes:
       - ./config/ocis/entrypoint-override.sh:/entrypoint-override.sh
-      - ocis-data:/var/tmp/ocis
+      - ocis-data:/var/lib/ocis
     labels:
       - "traefik.enable=true"
       - "traefik.http.routers.ocis.entrypoints=https"
diff --git a/deployments/examples/ocis_traefik/docker-compose.yml b/deployments/examples/ocis_traefik/docker-compose.yml
index c01e4e1a6e..029f718b24 100644
--- a/deployments/examples/ocis_traefik/docker-compose.yml
+++ b/deployments/examples/ocis_traefik/docker-compose.yml
@@ -62,7 +62,7 @@ services:
       OCIS_MACHINE_AUTH_API_KEY: ${OCIS_MACHINE_AUTH_API_KEY:-change-me-please}
     volumes:
       - ./config/ocis/entrypoint-override.sh:/entrypoint-override.sh
-      - ocis-data:/var/tmp/ocis
+      - ocis-data:/var/lib/ocis
     labels:
       - "traefik.enable=true"
       - "traefik.http.routers.ocis.entrypoints=https"
diff --git a/deployments/examples/ocis_wopi/docker-compose.yml b/deployments/examples/ocis_wopi/docker-compose.yml
index 09b46ff147..473f9db594 100644
--- a/deployments/examples/ocis_wopi/docker-compose.yml
+++ b/deployments/examples/ocis_wopi/docker-compose.yml
@@ -72,7 +72,7 @@ services:
     volumes:
       - ./config/ocis/entrypoint-override.sh:/entrypoint-override.sh
       - ./config/ocis/mimetypes.json:/var/tmp/ocis/app-config/mimetypes.json
-      - ocis-data:/var/tmp/ocis
+      - ocis-data:/var/lib/ocis
     labels:
       - "traefik.enable=true"
       - "traefik.http.routers.ocis.entrypoints=https"
diff --git a/docs/extensions/storage/storages.md b/docs/extensions/storage/storages.md
index 6172dc10ef..9c5295e0b2 100644
--- a/docs/extensions/storage/storages.md
+++ b/docs/extensions/storage/storages.md
@@ -120,7 +120,7 @@ To provide the other storage aspects we plan to implement a FUSE overlay filesys
 This is the current default storage driver. While it implements the file tree (using redis, including id based lookup), ETag propagation, trash, versions and sharing (including expiry) using the data directory layout of ownCloud 10 it has [known limitations](https://github.com/owncloud/core/issues/28095) that cannot be fixed without changing the actual layout on disk.
 
 To setup it up properly in a distributed fashion, the storage-home and the storage-oc need to share the same underlying FS. Their "data" counterparts also need access to the same shared FS.
-For a simple docker-compose setup, you can create a volume which will be used by the "storage-storage-home", "storage-storage-home-data", "storage-storage-oc" and "storage-storage-oc-data" containers. Using the `owncloud/ocis` docker image, the volume would need to be hooked in the `/var/tmp/ocis` folder inside the containers.
+For a simple docker-compose setup, you can create a volume which will be used by the "storage-storage-home", "storage-storage-home-data", "storage-storage-oc" and "storage-storage-oc-data" containers. Using the `owncloud/ocis` docker image, the volume would need to be hooked in the `/var/lib/ocis` folder inside the containers.
 
 - tree provided by a POSIX filesystem
   - file layout is mapped to the old ownCloud 10 layout
diff --git a/docs/ocis/getting-started/_index.md b/docs/ocis/getting-started/_index.md
index ddfb5144da..b602fcadab 100644
--- a/docs/ocis/getting-started/_index.md
+++ b/docs/ocis/getting-started/_index.md
@@ -46,7 +46,7 @@ chmod +x ocis
 ./ocis server
 ```
 
-The default primary storage location is `/var/tmp/ocis`. You can change that value by configuration.
+The default primary storage location is `~/.ocis` or `/var/lib/ocis` depending on the packaging format and your operating system user. You can change that value by configuration.
 
 {{< hint warning >}}
 oCIS by default relies on Multicast DNS (mDNS), usually via avahi-daemon. If your system has a firewall, make sure mDNS is allowed in your active zone.
diff --git a/glauth/pkg/flagset/flagset.go b/glauth/pkg/flagset/flagset.go
index 74b85dd746..9b939e0d4e 100644
--- a/glauth/pkg/flagset/flagset.go
+++ b/glauth/pkg/flagset/flagset.go
@@ -4,8 +4,8 @@ import (
 	"path"
 
 	"github.com/owncloud/ocis/glauth/pkg/config"
+	"github.com/owncloud/ocis/ocis-pkg/config/defaults"
 	"github.com/owncloud/ocis/ocis-pkg/flags"
-	pkgos "github.com/owncloud/ocis/ocis-pkg/os"
 	"github.com/urfave/cli/v2"
 )
 
@@ -148,27 +148,27 @@ func ServerWithConfig(cfg *config.Config) []cli.Flag {
 		&cli.StringFlag{
 			Name:        "ldaps-addr",
 			Value:       flags.OverrideDefaultString(cfg.Ldaps.Addr, "127.0.0.1:9126"),
-			Usage:       "Address to bind ldap server",
+			Usage:       "Address to bind ldaps server",
 			EnvVars:     []string{"GLAUTH_LDAPS_ADDR"},
 			Destination: &cfg.Ldaps.Addr,
 		},
 		&cli.BoolFlag{
 			Name:        "ldaps-enabled",
 			Value:       flags.OverrideDefaultBool(cfg.Ldaps.Enabled, true),
-			Usage:       "Enable ldap server",
+			Usage:       "Enable ldaps server",
 			EnvVars:     []string{"GLAUTH_LDAPS_ENABLED"},
 			Destination: &cfg.Ldaps.Enabled,
 		},
 		&cli.StringFlag{
 			Name:        "ldaps-cert",
-			Value:       flags.OverrideDefaultString(cfg.Ldaps.Cert, path.Join(pkgos.MustUserConfigDir("ocis", "ldap"), "ldap.crt")),
+			Value:       flags.OverrideDefaultString(cfg.Ldaps.Cert, path.Join(defaults.BaseDataPath(), "ldap", "ldap.crt")),
 			Usage:       "path to ldaps certificate in PEM format",
 			EnvVars:     []string{"GLAUTH_LDAPS_CERT"},
 			Destination: &cfg.Ldaps.Cert,
 		},
 		&cli.StringFlag{
 			Name:        "ldaps-key",
-			Value:       flags.OverrideDefaultString(cfg.Ldaps.Key, path.Join(pkgos.MustUserConfigDir("ocis", "ldap"), "ldap.key")),
+			Value:       flags.OverrideDefaultString(cfg.Ldaps.Key, path.Join(defaults.BaseDataPath(), "ldap", "ldap.key")),
 			Usage:       "path to ldaps key in PEM format",
 			EnvVars:     []string{"GLAUTH_LDAPS_KEY"},
 			Destination: &cfg.Ldaps.Key,
diff --git a/idp/pkg/flagset/flagset.go b/idp/pkg/flagset/flagset.go
index 649e11a996..fbb36d2194 100644
--- a/idp/pkg/flagset/flagset.go
+++ b/idp/pkg/flagset/flagset.go
@@ -4,8 +4,8 @@ import (
 	"path"
 
 	"github.com/owncloud/ocis/idp/pkg/config"
+	"github.com/owncloud/ocis/ocis-pkg/config/defaults"
 	"github.com/owncloud/ocis/ocis-pkg/flags"
-	pkgos "github.com/owncloud/ocis/ocis-pkg/os"
 	"github.com/urfave/cli/v2"
 )
 
@@ -236,14 +236,14 @@ func ServerWithConfig(cfg *config.Config) []cli.Flag {
 		},
 		&cli.StringFlag{
 			Name:        "transport-tls-cert",
-			Value:       flags.OverrideDefaultString(cfg.HTTP.TLSCert, path.Join(pkgos.MustUserConfigDir("ocis", "idp"), "server.crt")),
+			Value:       flags.OverrideDefaultString(cfg.HTTP.TLSCert, path.Join(defaults.BaseDataPath(), "idp", "server.crt")),
 			Usage:       "Certificate file for transport encryption",
 			EnvVars:     []string{"IDP_TRANSPORT_TLS_CERT"},
 			Destination: &cfg.HTTP.TLSCert,
 		},
 		&cli.StringFlag{
 			Name:        "transport-tls-key",
-			Value:       flags.OverrideDefaultString(cfg.HTTP.TLSKey, path.Join(pkgos.MustUserConfigDir("ocis", "idp"), "server.key")),
+			Value:       flags.OverrideDefaultString(cfg.HTTP.TLSKey, path.Join(defaults.BaseDataPath(), "idp", "server.key")),
 			Usage:       "Secret file for transport encryption",
 			EnvVars:     []string{"IDP_TRANSPORT_TLS_KEY"},
 			Destination: &cfg.HTTP.TLSKey,
@@ -335,14 +335,14 @@ func ServerWithConfig(cfg *config.Config) []cli.Flag {
 			Name:        "identifier-client-path",
 			Usage:       "Path to the identifier web client base folder",
 			EnvVars:     []string{"IDP_IDENTIFIER_CLIENT_PATH"},
-			Value:       flags.OverrideDefaultString(cfg.IDP.IdentifierClientPath, "/var/tmp/ocis/idp"),
+			Value:       flags.OverrideDefaultString(cfg.IDP.IdentifierClientPath, path.Join(defaults.BaseDataPath(), "idp")),
 			Destination: &cfg.IDP.IdentifierClientPath,
 		},
 		&cli.StringFlag{
 			Name:        "identifier-registration-conf",
 			Usage:       "Path to a identifier-registration.yaml configuration file",
 			EnvVars:     []string{"IDP_IDENTIFIER_REGISTRATION_CONF"},
-			Value:       flags.OverrideDefaultString(cfg.IDP.IdentifierRegistrationConf, "./config/identifier-registration.yaml"),
+			Value:       flags.OverrideDefaultString(cfg.IDP.IdentifierRegistrationConf, path.Join(defaults.BaseDataPath(), "idp", "identifier-registration.yaml")),
 			Destination: &cfg.IDP.IdentifierRegistrationConf,
 		},
 		&cli.StringFlag{
diff --git a/idp/pkg/server/http/server.go b/idp/pkg/server/http/server.go
index 22c38a5c28..dae7b49be1 100644
--- a/idp/pkg/server/http/server.go
+++ b/idp/pkg/server/http/server.go
@@ -18,20 +18,15 @@ func Server(opts ...Option) (http.Service, error) {
 
 	var tlsConfig *tls.Config
 	if options.Config.HTTP.TLS {
-		if options.Config.HTTP.TLSCert == "" || options.Config.HTTP.TLSKey == "" {
-			_, certErr := os.Stat("./server.crt")
-			_, keyErr := os.Stat("./server.key")
+		_, certErr := os.Stat(options.Config.HTTP.TLSCert)
+		_, keyErr := os.Stat(options.Config.HTTP.TLSKey)
 
-			if os.IsNotExist(certErr) || os.IsNotExist(keyErr) {
-				options.Logger.Info().Msgf("Generating certs")
-				if err := pkgcrypto.GenCert(options.Config.HTTP.TLSCert, options.Config.HTTP.TLSKey, options.Logger); err != nil {
-					options.Logger.Fatal().Err(err).Msg("Could not setup TLS")
-					os.Exit(1)
-				}
+		if os.IsNotExist(certErr) || os.IsNotExist(keyErr) {
+			options.Logger.Info().Msgf("Generating certs")
+			if err := pkgcrypto.GenCert(options.Config.HTTP.TLSCert, options.Config.HTTP.TLSKey, options.Logger); err != nil {
+				options.Logger.Fatal().Err(err).Msg("Could not setup TLS")
+				os.Exit(1)
 			}
-
-			options.Config.HTTP.TLSCert = "server.crt"
-			options.Config.HTTP.TLSKey = "server.key"
 		}
 
 		cer, err := tls.LoadX509KeyPair(options.Config.HTTP.TLSCert, options.Config.HTTP.TLSKey)
diff --git a/ocis-pkg/.gitignore b/ocis-pkg/.gitignore
new file mode 100644
index 0000000000..d5702b886d
--- /dev/null
+++ b/ocis-pkg/.gitignore
@@ -0,0 +1 @@
+!config
diff --git a/ocis-pkg/config/defaults/paths.go b/ocis-pkg/config/defaults/paths.go
new file mode 100644
index 0000000000..73abf077d7
--- /dev/null
+++ b/ocis-pkg/config/defaults/paths.go
@@ -0,0 +1,42 @@
+package defaults
+
+import (
+	"log"
+	"os"
+	"path"
+)
+
+const ()
+
+var (
+	// switch between modes
+	BaseDataPathType string = "homedir"
+	// don't read from this, only write
+	BaseDataPathValue string = "/var/lib/ocis"
+)
+
+func BaseDataPath() string {
+
+	// It is not nice to have hidden / secrete configuration options
+	// But how can we update the base path for every occurence with a flageset option?
+	// This is currenlty not possible and needs a new configuration concept
+	p := os.Getenv("OCIS_BASE_DATA_PATH")
+	if p != "" {
+		return p
+	}
+
+	switch BaseDataPathType {
+	case "homedir":
+		dir, err := os.UserHomeDir()
+		if err != nil {
+			// fallback to BaseDatapathValue for users without home
+			return BaseDataPathValue
+		}
+		return path.Join(dir, ".ocis")
+	case "path":
+		return BaseDataPathValue
+	default:
+		log.Fatalf("BaseDataPathType %s not found", BaseDataPathType)
+		return ""
+	}
+}
diff --git a/ocis-pkg/indexer/index/cs3/autoincrement_test.go b/ocis-pkg/indexer/index/cs3/autoincrement_test.go
index 1547e35ee3..6d15a74299 100644
--- a/ocis-pkg/indexer/index/cs3/autoincrement_test.go
+++ b/ocis-pkg/indexer/index/cs3/autoincrement_test.go
@@ -11,7 +11,7 @@ package cs3
 //	"github.com/stretchr/testify/assert"
 //)
 //
-//const cs3RootFolder = "/var/tmp/ocis/storage/users/data"
+//const cs3RootFolder = "/tmp/ocis/storage/users/data"
 //
 //func TestAutoincrementIndexAdd(t *testing.T) {
 //	dataDir, err := WriteIndexTestData(Data, "ID", cs3RootFolder)
diff --git a/ocis-pkg/indexer/index/cs3/non_unique.go b/ocis-pkg/indexer/index/cs3/non_unique.go
index 3f8ad59bd7..d7715d60c3 100644
--- a/ocis-pkg/indexer/index/cs3/non_unique.go
+++ b/ocis-pkg/indexer/index/cs3/non_unique.go
@@ -46,14 +46,14 @@ type NonUnique struct {
 }
 
 // NewNonUniqueIndexWithOptions instantiates a new NonUniqueIndex instance.
-// /var/tmp/ocis/accounts/index.cs3/Pets/Bro*
+// /tmp/ocis/accounts/index.cs3/Pets/Bro*
 // ├── Brown/
-// │   └── rebef-123 -> /var/tmp/testfiles-395764020/pets/rebef-123
+// │   └── rebef-123 -> /tmp/testfiles-395764020/pets/rebef-123
 // ├── Green/
-// │    ├── goefe-789 -> /var/tmp/testfiles-395764020/pets/goefe-789
-// │    └── xadaf-189 -> /var/tmp/testfiles-395764020/pets/xadaf-189
+// │    ├── goefe-789 -> /tmp/testfiles-395764020/pets/goefe-789
+// │    └── xadaf-189 -> /tmp/testfiles-395764020/pets/xadaf-189
 // └── White/
-//     └── wefwe-456 -> /var/tmp/testfiles-395764020/pets/wefwe-456
+//     └── wefwe-456 -> /tmp/testfiles-395764020/pets/wefwe-456
 func NewNonUniqueIndexWithOptions(o ...option.Option) index.Index {
 	opts := &option.Options{}
 	for _, opt := range o {
diff --git a/ocis-pkg/indexer/index/disk/autoincrement_test.go b/ocis-pkg/indexer/index/disk/autoincrement_test.go
index 6e59dd22df..998ad2af65 100644
--- a/ocis-pkg/indexer/index/disk/autoincrement_test.go
+++ b/ocis-pkg/indexer/index/disk/autoincrement_test.go
@@ -290,7 +290,7 @@ func BenchmarkAdd(b *testing.B) {
 }
 
 func createTmpDirStr() (string, error) {
-	name, err := ioutil.TempDir("/var/tmp", "testfiles-*")
+	name, err := ioutil.TempDir("/tmp", "testfiles-*")
 	if err != nil {
 		return "", err
 	}
diff --git a/ocis-pkg/indexer/index/disk/non_unique.go b/ocis-pkg/indexer/index/disk/non_unique.go
index 0cbe1948dc..90c4ed035a 100644
--- a/ocis-pkg/indexer/index/disk/non_unique.go
+++ b/ocis-pkg/indexer/index/disk/non_unique.go
@@ -16,14 +16,14 @@ import (
 
 // NonUnique is able to index an document by a key which might contain non-unique values
 //
-// /var/tmp/testfiles-395764020/index.disk/PetByColor/
+// /tmp/testfiles-395764020/index.disk/PetByColor/
 // ├── Brown
-// │   └── rebef-123 -> /var/tmp/testfiles-395764020/pets/rebef-123
+// │   └── rebef-123 -> /tmp/testfiles-395764020/pets/rebef-123
 // ├── Green
-// │    ├── goefe-789 -> /var/tmp/testfiles-395764020/pets/goefe-789
-// │    └── xadaf-189 -> /var/tmp/testfiles-395764020/pets/xadaf-189
+// │    ├── goefe-789 -> /tmp/testfiles-395764020/pets/goefe-789
+// │    └── xadaf-189 -> /tmp/testfiles-395764020/pets/xadaf-189
 // └── White
-//     └── wefwe-456 -> /var/tmp/testfiles-395764020/pets/wefwe-456
+//     └── wefwe-456 -> /tmp/testfiles-395764020/pets/wefwe-456
 type NonUnique struct {
 	caseInsensitive bool
 	indexBy         string
diff --git a/ocis-pkg/indexer/indexer_test.go b/ocis-pkg/indexer/indexer_test.go
index d75d326540..47440f1a27 100644
--- a/ocis-pkg/indexer/indexer_test.go
+++ b/ocis-pkg/indexer/indexer_test.go
@@ -14,7 +14,7 @@ import (
 	"github.com/stretchr/testify/assert"
 )
 
-//const cs3RootFolder = "/var/tmp/ocis/storage/users/data"
+//const cs3RootFolder = "/tmp/ocis/storage/users/data"
 //
 //func TestIndexer_CS3_AddWithUniqueIndex(t *testing.T) {
 //	dataDir, err := WriteIndexTestData(Data, "ID", cs3RootFolder)
diff --git a/ocis-pkg/indexer/test/helpers.go b/ocis-pkg/indexer/test/helpers.go
index eaad855ec3..b939aae6e9 100644
--- a/ocis-pkg/indexer/test/helpers.go
+++ b/ocis-pkg/indexer/test/helpers.go
@@ -10,7 +10,7 @@ import (
 
 // CreateTmpDir creates a temporary dir for tests data.
 func CreateTmpDir() (string, error) {
-	name, err := ioutil.TempDir("/var/tmp", "testfiles-")
+	name, err := ioutil.TempDir("/tmp", "testfiles-")
 	if err != nil {
 		return "", err
 	}
diff --git a/ocis-pkg/os/os.go b/ocis-pkg/os/os.go
deleted file mode 100644
index 3c3942aba7..0000000000
--- a/ocis-pkg/os/os.go
+++ /dev/null
@@ -1,17 +0,0 @@
-package os
-
-import (
-	"os"
-	"path/filepath"
-)
-
-// MustUserConfigDir generates a default config location for a user based on their OS. This location can be used to store
-// any artefacts the app needs for its functioning. It is a pure function. Its only side effect is that results vary
-// depending on which operative system we're in.
-func MustUserConfigDir(prefix, extension string) string {
-	dir, err := os.UserConfigDir()
-	if err != nil {
-		panic(err)
-	}
-	return filepath.Join(dir, prefix, extension)
-}
diff --git a/ocis-pkg/os/os_test.go b/ocis-pkg/os/os_test.go
deleted file mode 100644
index 9b11d79593..0000000000
--- a/ocis-pkg/os/os_test.go
+++ /dev/null
@@ -1,66 +0,0 @@
-package os_test
-
-import (
-	"os"
-	"path/filepath"
-	"testing"
-
-	pkgos "github.com/owncloud/ocis/ocis-pkg/os"
-)
-
-func TestMustUserConfigDir(t *testing.T) {
-	configDir, _ := os.UserConfigDir()
-	type args struct {
-		prefix    string
-		extension string
-	}
-	tests := []struct {
-		name      string
-		args      args
-		want      string
-		resetHome bool
-		panic     bool
-	}{
-		{
-			name: "fetch the default config location for the current user",
-			args: args{
-				prefix:    "ocis",
-				extension: "testing",
-			},
-			want: filepath.Join(configDir, "ocis", "testing"),
-		},
-		{
-			name: "location cannot be determined because $HOME is not set",
-			args: args{
-				prefix:    "ocis",
-				extension: "testing",
-			},
-			want:      filepath.Join(configDir, "ocis", "testing"),
-			resetHome: true,
-			panic:     true,
-		},
-	}
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			if tt.resetHome {
-				unsetHome(t)
-			}
-
-			defer func() {
-				if r := recover(); r != nil && !tt.panic {
-					t.Errorf("should have panicked but didn't")
-				}
-			}()
-
-			if got := pkgos.MustUserConfigDir(tt.args.prefix, tt.args.extension); got != tt.want {
-				t.Errorf("MustUserConfigDir() = %v, want %v", got, tt.want)
-			}
-		})
-	}
-}
-
-func unsetHome(t *testing.T) {
-	if err := os.Setenv("HOME", ""); err != nil {
-		t.Error(err)
-	}
-}
diff --git a/ocis/docker/Dockerfile.linux.amd64 b/ocis/docker/Dockerfile.linux.amd64
index 8e35ade669..475fc8fb32 100644
--- a/ocis/docker/Dockerfile.linux.amd64
+++ b/ocis/docker/Dockerfile.linux.amd64
@@ -22,24 +22,14 @@ LABEL maintainer="ownCloud GmbH <devops@owncloud.com>" \
   org.opencontainers.image.revision="${REVISION}"
 
 RUN addgroup -g 1000 -S ocis-group && \
-  adduser -S --ingroup ocis-group --uid 1000 ocis-user
+  adduser -S --ingroup ocis-group --uid 1000 ocis-user --home /var/lib/ocis
 
-RUN mkdir -p /var/tmp/ocis && \
- chown -R ocis-user:ocis-group /var/tmp/ocis && \
- chmod -R 777 /var/tmp/ocis
+RUN mkdir -p /var/lib/ocis && \
+ chown -R ocis-user:ocis-group /var/lib/ocis && \
+ chmod -R 777 /var/lib/ocis
 
-# default artifact location for autogenerated certificates
-# needs to be a static location because of the docker uid switch mechanism
-ENV STORAGE_LDAP_CACERT=/var/tmp/ocis/.config/ldap/ldaps.crt \
-  GLAUTH_LDAPS_CERT=/var/tmp/ocis/.config/ldap/ldaps.crt \
-  GLAUTH_LDAPS_KEY=/var/tmp/ocis/.config/ldap/ldaps.key \
-  IDP_TRANSPORT_TLS_CERT=/var/tmp/ocis/.config/idp/server.crt \
-  IDP_TRANSPORT_TLS_KEY=/var/tmp/ocis/.config/idp/server.key \
-  PROXY_TRANSPORT_TLS_CERT=/var/tmp/ocis/.config/proxy/server.crt \
-  PROXY_TRANSPORT_TLS_KEY=/var/tmp/ocis/.config/proxy/server.key
-
-VOLUME [ "/var/tmp/ocis" ]
-WORKDIR /var/tmp/ocis
+VOLUME [ "/var/lib/ocis" ]
+WORKDIR /var/lib/ocis
 
 USER 1000
 
diff --git a/ocis/docker/Dockerfile.linux.arm b/ocis/docker/Dockerfile.linux.arm
index f873b4795a..ea4cde97ef 100644
--- a/ocis/docker/Dockerfile.linux.arm
+++ b/ocis/docker/Dockerfile.linux.arm
@@ -22,24 +22,14 @@ LABEL maintainer="ownCloud GmbH <devops@owncloud.com>" \
   org.opencontainers.image.revision="${REVISION}"
 
 RUN addgroup -g 1000 -S ocis-group && \
-  adduser -S --ingroup ocis-group --uid 1000 ocis-user
+  adduser -S --ingroup ocis-group --uid 1000 ocis-user --home /var/lib/ocis
 
-RUN mkdir -p /var/tmp/ocis && \
- chown -R ocis-user:ocis-group /var/tmp/ocis && \
- chmod -R 777 /var/tmp/ocis
+RUN mkdir -p /var/lib/ocis && \
+ chown -R ocis-user:ocis-group /var/lib/ocis && \
+ chmod -R 777 /var/lib/ocis
 
-# default artifact location for autogenerated certificates
-# needs to be a static location because of the docker uid switch mechanism
-ENV STORAGE_LDAP_CACERT=/var/tmp/ocis/.config/ldap/ldaps.crt \
-  GLAUTH_LDAPS_CERT=/var/tmp/ocis/.config/ldap/ldaps.crt \
-  GLAUTH_LDAPS_KEY=/var/tmp/ocis/.config/ldap/ldaps.key \
-  IDP_TRANSPORT_TLS_CERT=/var/tmp/ocis/.config/idp/server.crt \
-  IDP_TRANSPORT_TLS_KEY=/var/tmp/ocis/.config/idp/server.key \
-  PROXY_TRANSPORT_TLS_CERT=/var/tmp/ocis/.config/proxy/server.crt \
-  PROXY_TRANSPORT_TLS_KEY=/var/tmp/ocis/.config/proxy/server.key
-
-VOLUME [ "/var/tmp/ocis" ]
-WORKDIR /var/tmp/ocis
+VOLUME [ "/var/lib/ocis" ]
+WORKDIR /var/lib/ocis
 
 USER 1000
 
diff --git a/ocis/docker/Dockerfile.linux.arm64 b/ocis/docker/Dockerfile.linux.arm64
index 23d633206e..2a2534d4f7 100644
--- a/ocis/docker/Dockerfile.linux.arm64
+++ b/ocis/docker/Dockerfile.linux.arm64
@@ -22,24 +22,14 @@ LABEL maintainer="ownCloud GmbH <devops@owncloud.com>" \
   org.opencontainers.image.revision="${REVISION}"
 
 RUN addgroup -g 1000 -S ocis-group && \
-  adduser -S --ingroup ocis-group --uid 1000 ocis-user
+  adduser -S --ingroup ocis-group --uid 1000 ocis-user --home /var/lib/ocis
 
-RUN mkdir -p /var/tmp/ocis && \
- chown -R ocis-user:ocis-group /var/tmp/ocis && \
- chmod -R 777 /var/tmp/ocis
+RUN mkdir -p /var/lib/ocis && \
+ chown -R ocis-user:ocis-group /var/lib/ocis && \
+ chmod -R 777 /var/lib/ocis
 
-# default artifact location for autogenerated certificates
-# needs to be a static location because of the docker uid switch mechanism
-ENV STORAGE_LDAP_CACERT=/var/tmp/ocis/.config/ldap/ldaps.crt \
-  GLAUTH_LDAPS_CERT=/var/tmp/ocis/.config/ldap/ldaps.crt \
-  GLAUTH_LDAPS_KEY=/var/tmp/ocis/.config/ldap/ldaps.key \
-  IDP_TRANSPORT_TLS_CERT=/var/tmp/ocis/.config/idp/server.crt \
-  IDP_TRANSPORT_TLS_KEY=/var/tmp/ocis/.config/idp/server.key \
-  PROXY_TRANSPORT_TLS_CERT=/var/tmp/ocis/.config/proxy/server.crt \
-  PROXY_TRANSPORT_TLS_KEY=/var/tmp/ocis/.config/proxy/server.key
-
-VOLUME [ "/var/tmp/ocis" ]
-WORKDIR /var/tmp/ocis
+VOLUME [ "/var/lib/ocis" ]
+WORKDIR /var/lib/ocis
 
 USER 1000
 
diff --git a/ocis/pkg/flagset/flagset.go b/ocis/pkg/flagset/flagset.go
index e97fea4495..68bcdb14a6 100644
--- a/ocis/pkg/flagset/flagset.go
+++ b/ocis/pkg/flagset/flagset.go
@@ -8,6 +8,14 @@ import (
 // RootWithConfig applies cfg to the root flagset
 func RootWithConfig(cfg *config.Config) []cli.Flag {
 	return []cli.Flag{
+		&cli.StringFlag{
+			// this is just a dummy config flag do document the existence
+			// of this environment variable
+			// the environment variable itself is used in `ocis-pkg/config/defaults/paths.go`
+			Name:    "ocis-base-data-path",
+			Usage:   "Set the base path where oCIS stores data",
+			EnvVars: []string{"OCIS_BASE_DATA_PATH"},
+		},
 		&cli.StringFlag{
 			Name:        "config-file",
 			Usage:       "Load config file from a non standard location.",
diff --git a/ocs/pkg/server/http/svc_test.go b/ocs/pkg/server/http/svc_test.go
index baad2067a0..28d4f4d1fd 100644
--- a/ocs/pkg/server/http/svc_test.go
+++ b/ocs/pkg/server/http/svc_test.go
@@ -222,7 +222,7 @@ func getFormatString(format string) string {
 }
 
 func createTmpDir() string {
-	name, err := ioutil.TempDir("/var/tmp", "ocis-accounts-store-")
+	name, err := ioutil.TempDir("/tmp", "ocis-accounts-store-")
 	if err != nil {
 		panic(err)
 	}
diff --git a/proxy/pkg/flagset/flagset.go b/proxy/pkg/flagset/flagset.go
index b330760bd1..2f1d6b8858 100644
--- a/proxy/pkg/flagset/flagset.go
+++ b/proxy/pkg/flagset/flagset.go
@@ -3,8 +3,8 @@ package flagset
 import (
 	"path"
 
+	"github.com/owncloud/ocis/ocis-pkg/config/defaults"
 	"github.com/owncloud/ocis/ocis-pkg/flags"
-	pkgos "github.com/owncloud/ocis/ocis-pkg/os"
 	"github.com/owncloud/ocis/proxy/pkg/config"
 	"github.com/urfave/cli/v2"
 )
@@ -156,14 +156,14 @@ func ServerWithConfig(cfg *config.Config) []cli.Flag {
 		},
 		&cli.StringFlag{
 			Name:        "transport-tls-cert",
-			Value:       flags.OverrideDefaultString(cfg.HTTP.TLSCert, path.Join(pkgos.MustUserConfigDir("ocis", "proxy"), "server.crt")),
+			Value:       flags.OverrideDefaultString(cfg.HTTP.TLSCert, path.Join(defaults.BaseDataPath(), "proxy", "server.crt")),
 			Usage:       "Certificate file for transport encryption",
 			EnvVars:     []string{"PROXY_TRANSPORT_TLS_CERT"},
 			Destination: &cfg.HTTP.TLSCert,
 		},
 		&cli.StringFlag{
 			Name:        "transport-tls-key",
-			Value:       flags.OverrideDefaultString(cfg.HTTP.TLSKey, path.Join(pkgos.MustUserConfigDir("ocis", "proxy"), "server.key")),
+			Value:       flags.OverrideDefaultString(cfg.HTTP.TLSKey, path.Join(defaults.BaseDataPath(), "proxy", "server.key")),
 			Usage:       "Secret file for transport encryption",
 			EnvVars:     []string{"PROXY_TRANSPORT_TLS_KEY"},
 			Destination: &cfg.HTTP.TLSKey,
diff --git a/settings/pkg/flagset/flagset.go b/settings/pkg/flagset/flagset.go
index 39ac38b94e..f4c7c4cff9 100644
--- a/settings/pkg/flagset/flagset.go
+++ b/settings/pkg/flagset/flagset.go
@@ -1,6 +1,9 @@
 package flagset
 
 import (
+	"path"
+
+	"github.com/owncloud/ocis/ocis-pkg/config/defaults"
 	"github.com/owncloud/ocis/ocis-pkg/flags"
 	"github.com/owncloud/ocis/settings/pkg/config"
 	"github.com/urfave/cli/v2"
@@ -171,7 +174,7 @@ func ServerWithConfig(cfg *config.Config) []cli.Flag {
 		},
 		&cli.StringFlag{
 			Name:        "data-path",
-			Value:       flags.OverrideDefaultString(cfg.Service.DataPath, "/var/tmp/ocis/settings"),
+			Value:       flags.OverrideDefaultString(cfg.Service.DataPath, path.Join(defaults.BaseDataPath(), "settings")),
 			Usage:       "Mount path for the storage",
 			EnvVars:     []string{"SETTINGS_DATA_PATH"},
 			Destination: &cfg.Service.DataPath,
diff --git a/settings/pkg/proto/v0/settings.pb.micro_test.go b/settings/pkg/proto/v0/settings.pb.micro_test.go
index 8e9e26c31c..786b6ffaf4 100644
--- a/settings/pkg/proto/v0/settings.pb.micro_test.go
+++ b/settings/pkg/proto/v0/settings.pb.micro_test.go
@@ -167,7 +167,7 @@ var (
 	}
 )
 
-const dataPath = "/var/tmp/grpc-tests-ocis-settings"
+const dataPath = "/tmp/grpc-tests-ocis-settings"
 
 func init() {
 	service = grpc.NewService(
diff --git a/settings/pkg/store/filesystem/store_test.go b/settings/pkg/store/filesystem/store_test.go
index 5f3becdf37..26f22d1ae7 100644
--- a/settings/pkg/store/filesystem/store_test.go
+++ b/settings/pkg/store/filesystem/store_test.go
@@ -30,7 +30,7 @@ const (
 	value2 = "2a0bd9b0-ca1d-491a-8c56-d2ddfd68ded8"
 	//value3 = "b42702d2-5e4d-4d73-b133-e1f9e285355e"
 
-	dataRoot = "/var/tmp/herecomesthesun"
+	dataRoot = "/tmp/herecomesthesun"
 )
 
 func burnRoot() {
diff --git a/storage/pkg/flagset/frontend.go b/storage/pkg/flagset/frontend.go
index 2e84707d19..9e2df08651 100644
--- a/storage/pkg/flagset/frontend.go
+++ b/storage/pkg/flagset/frontend.go
@@ -1,6 +1,9 @@
 package flagset
 
 import (
+	"path"
+
+	"github.com/owncloud/ocis/ocis-pkg/config/defaults"
 	"github.com/owncloud/ocis/ocis-pkg/flags"
 	"github.com/owncloud/ocis/storage/pkg/config"
 	"github.com/owncloud/ocis/storage/pkg/flagset/userdrivers"
@@ -32,13 +35,13 @@ func FrontendWithConfig(cfg *config.Config) []cli.Flag {
 
 		// OCDav
 
-		//&cli.StringFlag{
-		//	Name:        "chunk-folder",
-		//	Value:       flags.OverrideDefaultString(cfg.Reva.OCDav.WebdavNamespace, "/var/tmp/ocis/tmp/chunks"),
-		//	Usage:       "temp directory for chunked uploads",
-		//	EnvVars:     []string{"STORAGE_CHUNK_FOLDER"},
-		//	Destination: &cfg.Reva.OCDav.WebdavNamespace,
-		//},
+		&cli.StringFlag{
+			Name:        "chunk-folder",
+			Value:       flags.OverrideDefaultString(cfg.Reva.OCDav.WebdavNamespace, path.Join(defaults.BaseDataPath(), "tmp", "chunks")),
+			Usage:       "temp directory for chunked uploads",
+			EnvVars:     []string{"STORAGE_CHUNK_FOLDER"},
+			Destination: &cfg.Reva.OCDav.WebdavNamespace,
+		},
 
 		&cli.StringFlag{
 			Name:        "webdav-namespace",
diff --git a/storage/pkg/flagset/ldap.go b/storage/pkg/flagset/ldap.go
index e550a60d7c..94848dce28 100644
--- a/storage/pkg/flagset/ldap.go
+++ b/storage/pkg/flagset/ldap.go
@@ -3,8 +3,8 @@ package flagset
 import (
 	"path"
 
+	"github.com/owncloud/ocis/ocis-pkg/config/defaults"
 	"github.com/owncloud/ocis/ocis-pkg/flags"
-	pkgos "github.com/owncloud/ocis/ocis-pkg/os"
 	"github.com/owncloud/ocis/storage/pkg/config"
 	"github.com/urfave/cli/v2"
 )
@@ -28,7 +28,7 @@ func LDAPWithConfig(cfg *config.Config) []cli.Flag {
 		},
 		&cli.StringFlag{
 			Name:        "ldap-cacert",
-			Value:       flags.OverrideDefaultString(cfg.Reva.LDAP.CACert, path.Join(pkgos.MustUserConfigDir("ocis", "ldap"), "ldap.crt")),
+			Value:       flags.OverrideDefaultString(cfg.Reva.LDAP.CACert, path.Join(defaults.BaseDataPath(), "ldap", "ldap.crt")),
 			Usage:       "Path to a trusted Certificate file (in PEM format) for the LDAP Connection",
 			EnvVars:     []string{"STORAGE_LDAP_CACERT"},
 			Destination: &cfg.Reva.LDAP.CACert,
diff --git a/storage/pkg/flagset/metadatadrivers/driverlocal.go b/storage/pkg/flagset/metadatadrivers/driverlocal.go
index f1aac4aa3c..7ef4ddac3f 100644
--- a/storage/pkg/flagset/metadatadrivers/driverlocal.go
+++ b/storage/pkg/flagset/metadatadrivers/driverlocal.go
@@ -1,6 +1,9 @@
 package metadatadrivers
 
 import (
+	"path"
+
+	"github.com/owncloud/ocis/ocis-pkg/config/defaults"
 	"github.com/owncloud/ocis/ocis-pkg/flags"
 	"github.com/owncloud/ocis/storage/pkg/config"
 	"github.com/urfave/cli/v2"
@@ -11,7 +14,7 @@ func DriverLocalWithConfig(cfg *config.Config) []cli.Flag {
 	return []cli.Flag{
 		&cli.StringFlag{
 			Name:        "storage-local-root",
-			Value:       flags.OverrideDefaultString(cfg.Reva.MetadataStorage.Local.Root, "/var/tmp/ocis/storage/local"),
+			Value:       flags.OverrideDefaultString(cfg.Reva.MetadataStorage.Local.Root, path.Join(defaults.BaseDataPath(), "storage", "local", "metadata")),
 			Usage:       "the path to the local storage root",
 			EnvVars:     []string{"STORAGE_METADATA_DRIVER_LOCAL_ROOT"},
 			Destination: &cfg.Reva.MetadataStorage.Local.Root,
diff --git a/storage/pkg/flagset/metadatadrivers/driverocis.go b/storage/pkg/flagset/metadatadrivers/driverocis.go
index b9c89a3696..614b0bdaeb 100644
--- a/storage/pkg/flagset/metadatadrivers/driverocis.go
+++ b/storage/pkg/flagset/metadatadrivers/driverocis.go
@@ -1,6 +1,9 @@
 package metadatadrivers
 
 import (
+	"path"
+
+	"github.com/owncloud/ocis/ocis-pkg/config/defaults"
 	"github.com/owncloud/ocis/ocis-pkg/flags"
 	"github.com/owncloud/ocis/storage/pkg/config"
 	"github.com/urfave/cli/v2"
@@ -11,7 +14,7 @@ func DriverOCISWithConfig(cfg *config.Config) []cli.Flag {
 	return []cli.Flag{
 		&cli.StringFlag{
 			Name:        "storage-ocis-root",
-			Value:       flags.OverrideDefaultString(cfg.Reva.MetadataStorage.OCIS.Root, "/var/tmp/ocis/storage/metadata"),
+			Value:       flags.OverrideDefaultString(cfg.Reva.MetadataStorage.OCIS.Root, path.Join(defaults.BaseDataPath(), "storage", "metadata")),
 			Usage:       "the path to the local storage root",
 			EnvVars:     []string{"STORAGE_METADATA_DRIVER_OCIS_ROOT"},
 			Destination: &cfg.Reva.MetadataStorage.OCIS.Root,
diff --git a/storage/pkg/flagset/metadatadrivers/drivers3ng.go b/storage/pkg/flagset/metadatadrivers/drivers3ng.go
index b94e84a32c..81e394aaa8 100644
--- a/storage/pkg/flagset/metadatadrivers/drivers3ng.go
+++ b/storage/pkg/flagset/metadatadrivers/drivers3ng.go
@@ -1,6 +1,9 @@
 package metadatadrivers
 
 import (
+	"path"
+
+	"github.com/owncloud/ocis/ocis-pkg/config/defaults"
 	"github.com/owncloud/ocis/ocis-pkg/flags"
 	"github.com/owncloud/ocis/storage/pkg/config"
 	"github.com/urfave/cli/v2"
@@ -11,7 +14,7 @@ func DriverS3NGWithConfig(cfg *config.Config) []cli.Flag {
 	return []cli.Flag{
 		&cli.StringFlag{
 			Name:        "storage-s3ng-root",
-			Value:       flags.OverrideDefaultString(cfg.Reva.MetadataStorage.S3NG.Root, "/var/tmp/ocis/storage/metadata"),
+			Value:       flags.OverrideDefaultString(cfg.Reva.MetadataStorage.S3NG.Root, path.Join(defaults.BaseDataPath(), "storage", "metadata")),
 			Usage:       "the path to the local storage root",
 			EnvVars:     []string{"STORAGE_METADATA_DRIVER_S3NG_ROOT"},
 			Destination: &cfg.Reva.MetadataStorage.S3NG.Root,
diff --git a/storage/pkg/flagset/sharing.go b/storage/pkg/flagset/sharing.go
index c3dde8871c..1f54a2f6ec 100644
--- a/storage/pkg/flagset/sharing.go
+++ b/storage/pkg/flagset/sharing.go
@@ -1,6 +1,9 @@
 package flagset
 
 import (
+	"path"
+
+	"github.com/owncloud/ocis/ocis-pkg/config/defaults"
 	"github.com/owncloud/ocis/ocis-pkg/flags"
 	"github.com/owncloud/ocis/storage/pkg/config"
 	"github.com/urfave/cli/v2"
@@ -62,7 +65,7 @@ func SharingWithConfig(cfg *config.Config) []cli.Flag {
 		},
 		&cli.StringFlag{
 			Name:        "user-json-file",
-			Value:       flags.OverrideDefaultString(cfg.Reva.Sharing.UserJSONFile, "/var/tmp/ocis/storage/shares.json"),
+			Value:       flags.OverrideDefaultString(cfg.Reva.Sharing.UserJSONFile, path.Join(defaults.BaseDataPath(), "storage", "shares.json")),
 			Usage:       "file used to persist shares for the UserShareProvider",
 			EnvVars:     []string{"STORAGE_SHARING_USER_JSON_FILE"},
 			Destination: &cfg.Reva.Sharing.UserJSONFile,
@@ -76,7 +79,7 @@ func SharingWithConfig(cfg *config.Config) []cli.Flag {
 		},
 		&cli.StringFlag{
 			Name:        "public-json-file",
-			Value:       flags.OverrideDefaultString(cfg.Reva.Sharing.PublicJSONFile, "/var/tmp/ocis/storage/publicshares.json"),
+			Value:       flags.OverrideDefaultString(cfg.Reva.Sharing.PublicJSONFile, path.Join(defaults.BaseDataPath(), "storage", "publicshares.json")),
 			Usage:       "file used to persist shares for the PublicShareProvider",
 			EnvVars:     []string{"STORAGE_SHARING_PUBLIC_JSON_FILE"},
 			Destination: &cfg.Reva.Sharing.PublicJSONFile,
diff --git a/storage/pkg/flagset/storagehome.go b/storage/pkg/flagset/storagehome.go
index 2efb5d1846..6df9bf0c51 100644
--- a/storage/pkg/flagset/storagehome.go
+++ b/storage/pkg/flagset/storagehome.go
@@ -1,6 +1,9 @@
 package flagset
 
 import (
+	"path"
+
+	"github.com/owncloud/ocis/ocis-pkg/config/defaults"
 	"github.com/owncloud/ocis/ocis-pkg/flags"
 	"github.com/owncloud/ocis/storage/pkg/config"
 	"github.com/owncloud/ocis/storage/pkg/flagset/userdrivers"
@@ -122,7 +125,7 @@ func StorageHomeWithConfig(cfg *config.Config) []cli.Flag {
 		},
 		&cli.StringFlag{
 			Name:        "tmp-folder",
-			Value:       flags.OverrideDefaultString(cfg.Reva.StorageHome.TempFolder, "/var/tmp/ocis/tmp/home"),
+			Value:       flags.OverrideDefaultString(cfg.Reva.StorageHome.TempFolder, path.Join(defaults.BaseDataPath(), "tmp", "home")),
 			Usage:       "path to tmp folder",
 			EnvVars:     []string{"STORAGE_HOME_TMP_FOLDER"},
 			Destination: &cfg.Reva.StorageHome.TempFolder,
diff --git a/storage/pkg/flagset/storagemetadata.go b/storage/pkg/flagset/storagemetadata.go
index efe2db52ac..6af75d2e3e 100644
--- a/storage/pkg/flagset/storagemetadata.go
+++ b/storage/pkg/flagset/storagemetadata.go
@@ -1,6 +1,9 @@
 package flagset
 
 import (
+	"path"
+
+	"github.com/owncloud/ocis/ocis-pkg/config/defaults"
 	"github.com/owncloud/ocis/ocis-pkg/flags"
 	"github.com/owncloud/ocis/storage/pkg/config"
 	"github.com/owncloud/ocis/storage/pkg/flagset/metadatadrivers"
@@ -54,7 +57,7 @@ func StorageMetadata(cfg *config.Config) []cli.Flag {
 		},
 		&cli.StringFlag{
 			Name:        "tmp-folder",
-			Value:       flags.OverrideDefaultString(cfg.Reva.StorageMetadata.TempFolder, "/var/tmp/ocis/tmp/metadata"),
+			Value:       flags.OverrideDefaultString(cfg.Reva.StorageMetadata.TempFolder, path.Join(defaults.BaseDataPath(), "tmp", "metadata")),
 			Usage:       "path to tmp folder",
 			EnvVars:     []string{"STORAGE_METADATA_TMP_FOLDER"},
 			Destination: &cfg.Reva.StorageMetadata.TempFolder,
diff --git a/storage/pkg/flagset/storageusers.go b/storage/pkg/flagset/storageusers.go
index b61d23f51b..b801d2dd84 100644
--- a/storage/pkg/flagset/storageusers.go
+++ b/storage/pkg/flagset/storageusers.go
@@ -1,6 +1,9 @@
 package flagset
 
 import (
+	"path"
+
+	"github.com/owncloud/ocis/ocis-pkg/config/defaults"
 	"github.com/owncloud/ocis/ocis-pkg/flags"
 	"github.com/owncloud/ocis/storage/pkg/config"
 	"github.com/owncloud/ocis/storage/pkg/flagset/userdrivers"
@@ -119,7 +122,7 @@ func StorageUsersWithConfig(cfg *config.Config) []cli.Flag {
 		},
 		&cli.StringFlag{
 			Name:        "tmp-folder",
-			Value:       flags.OverrideDefaultString(cfg.Reva.StorageUsers.TempFolder, "/var/tmp/ocis/tmp/users"),
+			Value:       flags.OverrideDefaultString(cfg.Reva.StorageUsers.TempFolder, path.Join(defaults.BaseDataPath(), "tmp", "users")),
 			Usage:       "path to tmp folder",
 			EnvVars:     []string{"STORAGE_USERS_TMP_FOLDER"},
 			Destination: &cfg.Reva.StorageUsers.TempFolder,
diff --git a/storage/pkg/flagset/userdrivers/driverlocal.go b/storage/pkg/flagset/userdrivers/driverlocal.go
index 049178a41e..212b202e74 100644
--- a/storage/pkg/flagset/userdrivers/driverlocal.go
+++ b/storage/pkg/flagset/userdrivers/driverlocal.go
@@ -1,6 +1,9 @@
 package userdrivers
 
 import (
+	"path"
+
+	"github.com/owncloud/ocis/ocis-pkg/config/defaults"
 	"github.com/owncloud/ocis/ocis-pkg/flags"
 	"github.com/owncloud/ocis/storage/pkg/config"
 	"github.com/urfave/cli/v2"
@@ -11,7 +14,7 @@ func DriverLocalWithConfig(cfg *config.Config) []cli.Flag {
 	return []cli.Flag{
 		&cli.StringFlag{
 			Name:        "storage-local-root",
-			Value:       flags.OverrideDefaultString(cfg.Reva.UserStorage.Local.Root, "/var/tmp/ocis/storage/local"),
+			Value:       flags.OverrideDefaultString(cfg.Reva.UserStorage.Local.Root, path.Join(defaults.BaseDataPath(), "storage", "local", "users")),
 			Usage:       "the path to the local storage root",
 			EnvVars:     []string{"STORAGE_USERS_DRIVER_LOCAL_ROOT"},
 			Destination: &cfg.Reva.UserStorage.Local.Root,
diff --git a/storage/pkg/flagset/userdrivers/driverocis.go b/storage/pkg/flagset/userdrivers/driverocis.go
index fd7e0f2260..35aa986835 100644
--- a/storage/pkg/flagset/userdrivers/driverocis.go
+++ b/storage/pkg/flagset/userdrivers/driverocis.go
@@ -1,6 +1,9 @@
 package userdrivers
 
 import (
+	"path"
+
+	"github.com/owncloud/ocis/ocis-pkg/config/defaults"
 	"github.com/owncloud/ocis/ocis-pkg/flags"
 	"github.com/owncloud/ocis/storage/pkg/config"
 	"github.com/urfave/cli/v2"
@@ -11,7 +14,7 @@ func DriverOCISWithConfig(cfg *config.Config) []cli.Flag {
 	return []cli.Flag{
 		&cli.StringFlag{
 			Name:        "storage-ocis-root",
-			Value:       flags.OverrideDefaultString(cfg.Reva.UserStorage.OCIS.Root, "/var/tmp/ocis/storage/users"),
+			Value:       flags.OverrideDefaultString(cfg.Reva.UserStorage.OCIS.Root, path.Join(defaults.BaseDataPath(), "storage", "users")),
 			Usage:       "the path to the local storage root",
 			EnvVars:     []string{"STORAGE_USERS_DRIVER_OCIS_ROOT"},
 			Destination: &cfg.Reva.UserStorage.OCIS.Root,
diff --git a/storage/pkg/flagset/userdrivers/driverowncloud.go b/storage/pkg/flagset/userdrivers/driverowncloud.go
index 1ba06b2fdd..395b28325c 100644
--- a/storage/pkg/flagset/userdrivers/driverowncloud.go
+++ b/storage/pkg/flagset/userdrivers/driverowncloud.go
@@ -1,6 +1,9 @@
 package userdrivers
 
 import (
+	"path"
+
+	"github.com/owncloud/ocis/ocis-pkg/config/defaults"
 	"github.com/owncloud/ocis/ocis-pkg/flags"
 	"github.com/owncloud/ocis/storage/pkg/config"
 	"github.com/urfave/cli/v2"
@@ -11,14 +14,14 @@ func DriverOwnCloudWithConfig(cfg *config.Config) []cli.Flag {
 	return []cli.Flag{
 		&cli.StringFlag{
 			Name:        "storage-owncloud-datadir",
-			Value:       flags.OverrideDefaultString(cfg.Reva.UserStorage.OwnCloud.Root, "/var/tmp/ocis/storage/owncloud"),
+			Value:       flags.OverrideDefaultString(cfg.Reva.UserStorage.OwnCloud.Root, path.Join(defaults.BaseDataPath(), "storage", "owncloud")),
 			Usage:       "the path to the owncloud data directory",
 			EnvVars:     []string{"STORAGE_USERS_DRIVER_OWNCLOUD_DATADIR"},
 			Destination: &cfg.Reva.UserStorage.OwnCloud.Root,
 		},
 		&cli.StringFlag{
 			Name:        "storage-owncloud-uploadinfo-dir",
-			Value:       flags.OverrideDefaultString(cfg.Reva.UserStorage.OwnCloud.UploadInfoDir, "/var/tmp/ocis/storage/uploadinfo"),
+			Value:       flags.OverrideDefaultString(cfg.Reva.UserStorage.OwnCloud.UploadInfoDir, path.Join(defaults.BaseDataPath(), "storage", "uploadinfo")),
 			Usage:       "the path to the tus upload info directory",
 			EnvVars:     []string{"STORAGE_USERS_DRIVER_OWNCLOUD_UPLOADINFO_DIR"},
 			Destination: &cfg.Reva.UserStorage.OwnCloud.UploadInfoDir,
diff --git a/storage/pkg/flagset/userdrivers/driverowncloudsql.go b/storage/pkg/flagset/userdrivers/driverowncloudsql.go
index 1b965af7d9..c0adb07dc2 100644
--- a/storage/pkg/flagset/userdrivers/driverowncloudsql.go
+++ b/storage/pkg/flagset/userdrivers/driverowncloudsql.go
@@ -1,6 +1,9 @@
 package userdrivers
 
 import (
+	"path"
+
+	"github.com/owncloud/ocis/ocis-pkg/config/defaults"
 	"github.com/owncloud/ocis/ocis-pkg/flags"
 	"github.com/owncloud/ocis/storage/pkg/config"
 	"github.com/urfave/cli/v2"
@@ -11,14 +14,14 @@ func DriverOwnCloudSQLWithConfig(cfg *config.Config) []cli.Flag {
 	return []cli.Flag{
 		&cli.StringFlag{
 			Name:        "storage-owncloudsql-datadir",
-			Value:       flags.OverrideDefaultString(cfg.Reva.UserStorage.OwnCloudSQL.Root, "/var/tmp/ocis/storage/owncloud"),
+			Value:       flags.OverrideDefaultString(cfg.Reva.UserStorage.OwnCloudSQL.Root, path.Join(defaults.BaseDataPath(), "storage", "owncloud")),
 			Usage:       "the path to the owncloudsql data directory",
 			EnvVars:     []string{"STORAGE_USERS_DRIVER_OWNCLOUDSQL_DATADIR"},
 			Destination: &cfg.Reva.UserStorage.OwnCloudSQL.Root,
 		},
 		&cli.StringFlag{
 			Name:        "storage-owncloudsql-uploadinfo-dir",
-			Value:       flags.OverrideDefaultString(cfg.Reva.UserStorage.OwnCloudSQL.UploadInfoDir, "/var/tmp/ocis/storage/uploadinfo"),
+			Value:       flags.OverrideDefaultString(cfg.Reva.UserStorage.OwnCloudSQL.UploadInfoDir, path.Join(defaults.BaseDataPath(), "storage", "uploadinfo")),
 			Usage:       "the path to the tus upload info directory",
 			EnvVars:     []string{"STORAGE_USERS_DRIVER_OWNCLOUDSQL_UPLOADINFO_DIR"},
 			Destination: &cfg.Reva.UserStorage.OwnCloudSQL.UploadInfoDir,
diff --git a/storage/pkg/flagset/userdrivers/drivers3ng.go b/storage/pkg/flagset/userdrivers/drivers3ng.go
index 434bb1b1e1..1b21e2a9cd 100644
--- a/storage/pkg/flagset/userdrivers/drivers3ng.go
+++ b/storage/pkg/flagset/userdrivers/drivers3ng.go
@@ -1,6 +1,9 @@
 package userdrivers
 
 import (
+	"path"
+
+	"github.com/owncloud/ocis/ocis-pkg/config/defaults"
 	"github.com/owncloud/ocis/ocis-pkg/flags"
 	"github.com/owncloud/ocis/storage/pkg/config"
 	"github.com/urfave/cli/v2"
@@ -11,7 +14,7 @@ func DriverS3NGWithConfig(cfg *config.Config) []cli.Flag {
 	return []cli.Flag{
 		&cli.StringFlag{
 			Name:        "storage-s3ng-root",
-			Value:       flags.OverrideDefaultString(cfg.Reva.UserStorage.S3NG.Root, "/var/tmp/ocis/storage/users"),
+			Value:       flags.OverrideDefaultString(cfg.Reva.UserStorage.S3NG.Root, path.Join(defaults.BaseDataPath(), "storage", "users")),
 			Usage:       "the path to the local storage root",
 			EnvVars:     []string{"STORAGE_USERS_DRIVER_S3NG_ROOT"},
 			Destination: &cfg.Reva.UserStorage.S3NG.Root,
diff --git a/store/pkg/flagset/flagset.go b/store/pkg/flagset/flagset.go
index 392c79f6f6..2651bbf983 100644
--- a/store/pkg/flagset/flagset.go
+++ b/store/pkg/flagset/flagset.go
@@ -1,6 +1,9 @@
 package flagset
 
 import (
+	"path"
+
+	"github.com/owncloud/ocis/ocis-pkg/config/defaults"
 	"github.com/owncloud/ocis/ocis-pkg/flags"
 	"github.com/owncloud/ocis/store/pkg/config"
 	"github.com/urfave/cli/v2"
@@ -142,7 +145,7 @@ func ServerWithConfig(cfg *config.Config) []cli.Flag {
 		},
 		&cli.StringFlag{
 			Name:        "data-path",
-			Value:       flags.OverrideDefaultString(cfg.Datapath, "/var/tmp/ocis/store"),
+			Value:       flags.OverrideDefaultString(cfg.Datapath, path.Join(defaults.BaseDataPath(), "store")),
 			Usage:       "location of the store data path",
 			EnvVars:     []string{"STORE_DATA_PATH"},
 			Destination: &cfg.Datapath,
diff --git a/store/pkg/service/v0/service.go b/store/pkg/service/v0/service.go
index 1994110944..c1a5cc98d9 100644
--- a/store/pkg/service/v0/service.go
+++ b/store/pkg/service/v0/service.go
@@ -242,7 +242,7 @@ func (s *Service) Tables(ctx context.Context, in *proto.TablesRequest, out *prot
 }
 
 // TODO sanitize key. As it may contain invalid characters, such as slashes.
-// file: /var/tmp/ocis/store/databases/{database}/{table}/{record.key}.
+// file: /tmp/ocis-store/databases/{database}/{table}/{record.key}.
 func getID(database string, table string, key string) string {
 	// TODO sanitize input.
 	return filepath.Join(database, table, key)
diff --git a/thumbnails/pkg/flagset/flagset.go b/thumbnails/pkg/flagset/flagset.go
index 16dd5a9d98..6a877400e9 100644
--- a/thumbnails/pkg/flagset/flagset.go
+++ b/thumbnails/pkg/flagset/flagset.go
@@ -1,6 +1,9 @@
 package flagset
 
 import (
+	"path"
+
+	"github.com/owncloud/ocis/ocis-pkg/config/defaults"
 	"github.com/owncloud/ocis/ocis-pkg/flags"
 
 	"github.com/owncloud/ocis/thumbnails/pkg/config"
@@ -137,7 +140,7 @@ func ServerWithConfig(cfg *config.Config) []cli.Flag {
 		},
 		&cli.StringFlag{
 			Name:        "filesystemstorage-root",
-			Value:       "/var/tmp/ocis/thumbnails",
+			Value:       flags.OverrideDefaultString(cfg.Thumbnail.FileSystemStorage.RootDirectory, path.Join(defaults.BaseDataPath(), "thumbnails")),
 			Usage:       "Root path of the filesystem storage directory",
 			EnvVars:     []string{"THUMBNAILS_FILESYSTEMSTORAGE_ROOT"},
 			Destination: &cfg.Thumbnail.FileSystemStorage.RootDirectory,