code: func (r *runner) setupUserEnv(ctx context.Context, args *pb.RunnerArgs, userAuth *authctx.Context, logdogServ *logdogServer, logdogNamespace string) (environ.Env, error) {
  	ret := environ.System()
  	userAuth.ExportIntoEnv(ret)
  	if err := logdogServ.ExportIntoEnv(ret); err != nil {
  		return environ.Env{}, err
  	}
  	ret.Set("LOGDOG_NAMESPACE", logdogNamespace)
  
  	// Prepare user LUCI context.
  	ctx, err := lucictx.Set(ctx, "luci_executable", map[string]string{
  		"cache_dir": args.CacheDir,
  	})
  	if err != nil {
  		return environ.Env{}, err
  	}
  	lctx, err := lucictx.ExportInto(ctx, args.WorkDir)
  	if err != nil {
  		return environ.Env{}, err
  	}
  	lctx.SetInEnviron(ret)
  
  	// Prepare a user temp dir.
  	// Note that we can't use workdir directly because some overzealous scripts
  	// like to remove everything they find under TEMPDIR, and it breaks LUCI
  	// runner internals that keep some files in workdir (in particular git and
  	// gsutil configs setup by AuthContext).
  	userTempDir := filepath.Join(args.WorkDir, "ut")
  	if err := os.MkdirAll(userTempDir, 0700); err != nil {
  		return environ.Env{}, errors.Annotate(err, "failed to create temp dir").Err()
  	}
  	for _, v := range []string{"TEMPDIR", "TMPDIR", "TEMP", "TMP", "MAC_CHROMIUM_TMPDIR"} {
  		ret.Set(v, userTempDir)
  	}
  
  	return ret, nil
  }
docs: // setupUserEnv prepares user subprocess environment.