I'm running multiple web-applications on single VPS, traffic goes through a proxy (nginx) which dispatches requests.

I think to run each of them in their own chrooted environment. Would it secure VPS from being completely hacked, when one of applications is hacked?


It provides reasonable filesystem isolation for non-root processes. However, chroot has several limitations. Mainly, the root user can easily escape from the environment. It would be better to use an isolated environment that provides root privilege isolation, such FreeBSD jails, Linux containers, or Docker.

If a hacker finds a way to exploit the web application in a way that allows him/her to run some code as root, chroot only provides the protection that the hacker may not know he/she is in a chrooted environment. If discovered, the hacker could run some trivial code to chroot into the system that you are trying to protect. This is not so much the case with the other technologies mentioned above, where a root escape would be considered a vulnerability in that technology rather than expected behavior.

The answer to your question comes down to what is enough for you given the specific services and web applications being exposed.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.