Hosting apps in jails along with reverse proxy and nginx.
reddit / freebsd

----------------------------------------------------------------------
Hard_vard · 2023-12-28 11:01

Good morning my little devils.

I ran fbsd on an additional server for educational purposes. I
installed and configured nginx. I manage my jails through bastille
with vnet. Jails can be accessed by reverse nginx proxies.

I wanted to ask about how I should manage apps inside this jail.

Premise: A very simple application of flask with gunicorn.

Should I create a new jail user or can I run apps from root?

Should I create an additional service that will run the application,
or is it better to run it in a different way?

Thank you in advance for your reply!

----------------------------------------------------------------------
jdugaduc · 2023-12-28 11:12

I’d advise you to not use root. It’s better to even disable root
login. For your use case, the `www` user could be suitable. I
personally build ports of my services with `poudriere`, use a custom
package repository in the jails and just do `pkg -j myjail install
mypackage`.

----------------------------------------------------------------------
Hard_vard · 2023-12-28 11:20

Thanks for the reply. Building my own ports or services is probably an
unnecessary solution for my small applications.

----------------------------------------------------------------------
jdugaduc · 2023-12-28 11:26

It’s not hard at all but it’s your call. If you’re on 14, you can use
`tarfs` to mount your application directory and use an rc script to
daemonize it.

----------------------------------------------------------------------
mss-cyclist · 2023-12-28 19:43

Absolutely, whenever it is possible: do not run user applications or
daemons as root.

When there is a breach at least the attacker has no root access.