Re: automatic creation of a chroot environment

Hi,

> I've been using chroot for a long time to reduce
> the risk of web application hacking on my server.
> 
> Some time ago, I decided it was time to automate
> the creation of chroot environments and create a
> universal solution for any application/port that
> would be easily customizable.
> 
> For simple applications and ports, it usually works
> with minimal effort, but for complex ones, it takes
> a bit more tinkering.
> 
> The current implementation creates a RO chroot,
> without setuid files, with one user and one group.
> All RW locations are mounted with noexec and
> nosuid. This makes escaping such a chroot
> environment extremely difficult, and webshell
> and other PHP hacks become impossible.
> 
> I hope someone finds this useful.
> 
> https://github.com/rozhuk-im/chroot_env

Thank You for sharing, I will add this to next VN.

Two questions out of curiosity ...

1. How is that better then 'Service Jails'?

2. How is that better then 'Single Process Jails'?

https://vermaden.wordpress.com/2023/06/28/freebsd-jails-containers/#single-process-jails

Thanks,
vermaden