30
Dedicated service user or not ? (jlai.lu)
submitted 1 year ago by to c/selfhosted@lemmy.world
18 comments fedilink hide all child comments
 

Hi all !

As of today, I am running my services with rootless podman pods and containers. Each functional stack gets its dedicated user (user cloud runs a pod with nextcloud-fpm, nginx, postgresql...) with user mapping. Now, my thought were that if an attack can escape a container, it should be contained to a specific user.

Is it really meaningful ? With service users' home setup in /var/lib, it makes a lot of small stuff annoying and I wonder if the current setup is really worth it ?

you are viewing a single comment's thread
view the rest of the comments
[–] 2 points 1 year ago (1 child)

Companies do run multiple containers/pods on the same host. That is what Kubernetes does

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 0 points 1 year ago

    Sure, but those will usually be pieces of an app on the same host, not whole apps. Like for an inventory management app, you might have the auth server and its database on one host, the CRUD app and its database on another, and the report server, its database, and a replica of the CRUD db on another. And I use the term "host" broadly enough to include VMs on the same physical hardware. And these hosts will have restricted communication between each other.

    At least, that's how I've seen it done.

    Self-hosters will generally run multiple full apps on one host. It's a different setup.

  • permalink
  • fedilink
  • source
  • parent