Allow nested /tmp generated images and per-room runtime workspace attachments after realpath/image validation.
Eyejoker