One shell user or many

ttavoy

This thread is more philosophical rather than a plea for immediate technical help, which might be a welcome change.

Webfaction has a philosophy of running all your websites on 1 user. One could create extra users but I never understood what they were useful for.

In contrast, Dreamhost has (or had when I was there) a philosophy of one user per website. I found this worked really nicely and gave a feeling of security (though that feeling may have been illusional).

It might be good to know where the Opalstack designers stand on this spectrum, if they have general intentions about which way we should go in order to take best advantage of the facilities, or is the idea here that either way is equally ok.

sean

ttavoy great question!

Our #1 consideration for this was application security. If you have your applications running as separate shell users then a single compromised application (looking at you, Wordpress 👀 ) can't reach out and infect other apps.

Here are a few other considerations:

Separating apps between shell users is also useful for project management, ie grouping apps under a single user for a particular project or client.
Instead of changing a lot of permissions to grant a "secondary" shell user access to an app running as a "primary" shell users (ie the WF way), you can just run things as that secondary user. This way you can look at the shell user as a shared login for whoever needs access to the app, instead of using multiple shell users (with intricate/fragile permissions) as identities for specific people who need access to one app.
Linux has per-user resource limits on things like the number of open file handles, the number of process threads, etc. If you're running a lot of apps as a single shell user, you might bump into those limits even if you're under your RAM and storage quotas. Running your apps as separate shell users makes it easier to avoid that.

There are probably a lot of other ways to take advantage of running apps as different shell users. Looking forward to reading about what you all are doing with them! 🙂