How to setup open_basedir for each site automatically at creation?

cristianuibar

How can I set up open_basedir ini var dynamically for each user?

Basically, I want to set the open_basedir ini var to something like this:
"/var/www/<site-id>/public_html:/var/lib/php/session:/tmp"

How to fill in the <site-id> dynamically and automatically for each new website automatically?

Nickske00

I'm not sure why you would need this? Websites on enhance live in their own container, so they can't access any other stuff on the system if I'm correct.

cristianuibar

Nickske00 I am not sure about that. I don't believe that's the case. I think only litespeed and SQL runs in containers, the rest is host-side.

I don't see a container for each website that runs on the server. There are only 4 containers running and a lot more websites. The 4 containers are for: mariadb, litespeed, ftpcd and filed.

So I guess not. Sites don't run in separate containers.

Adam

Every website runs in its own container. If you ssh or su to the website user, you will see what PHP sees.

cristianuibar

Adam

Hi Adam,

After doing some more research, I've confirmed that when I ssh into a website, I can see that I am inside a container due to the overlaying file system. When inspecting the docker OLS container, I found that each site has different mounts as overlays.

It appears that all sites run in a single docker container, utilizing different mount points (volumes/binds), virtual hosts, and different user/permissions.

However, I have concerns about whether this setup is safe enough. While I can confirm that I don't see other sites when ssh'd into a website, I worry that this arrangement exposes us to potential resource contention, file system access, shared process space, network access, and could lead to other problems in the future.

In my opinion, true isolation is best achieved by running each website in its own container. This way, each website operates in its own process space, preventing interference from other sites. Separate containers can also have isolated network configurations, and resources such as CPU and memory, can be allocated and limited per container. Furthermore, any security breach in one container would not impact the others.

Currently, the perceived isolation seems to come from not being able to see other websites' files, which is most likely due to proper directory permissions and structure.