I have a Linux web server (Debian, just in case that made a difference), which is Apache + PHP-FPM. Each Apache
VirtualHost uses a dedicated PHP-FPM pool (through a dedicated unix socket), which runs under a dedicated system user.
For example, let's say I have the example.com
VirtualHost. Then, in the
VirtualHost Apache config, I have something like
ProxyPassMatch ^/(.*\.php(/.*)?)$ unix:/run/php/php7.3-fpm-examplecom.sock|fcgi://127.0.0.1:9000/home/examplecom/htdocs/www.example.com/
/etc/php/7.3/fpm/pool.d/ I have the corresponding configuration file for the PHP-FPM pool, namely
examplecom.conf, which contains
[examplecom] user = examplecom listen = /run/php/php7.3-fpm-examplecom.sock ; and other things...
It happens, more often than not, some website gets hacked (forgot to update, installed shameless insecure plugins, you name it) and starts hogging available server resources: in my case hard disk I/O bandwidth is the most common.
In order to avoid DoS-ing all the websites on the same server, I'd like to limit the hard disk I/O bandwidth per website, so that a hacked website goes down alone and it does not take all the others with it.
How do I limit the hard disk I/O bandwidth per website? Well, I think I can limit that per user instead, since each
VirtualHost has a dedicated user. And how do I do that? Well, Google suggested me cgroups.
However I couldn't find any example about how to add a user, instead of a process ID, to a control group.
Am I looking for the wrong thing? Or am I searching for the wrong keywords? I don't know, but the question is: how do I limit per user hard disk I/O bandwidth using cgroups under Linux?