Operating principle and features

The ispmanager limiting module isolates files and processes and limits the resources of virtual hosting users. The module is an alternative to CloudLinux.

Limiting and isolation can be used together or separately.

Limiting

The module monitors PHP handler processes:

• Apache mod_php, mod_cgid, mod_fcgid modules 
• mod_lsphp — an ispmanager Apache module that allows PHP to run in LSAPI mode
• php-fpm

When a process is launched under a user, the module intercepts it and places it in a limited environment (Limited surrounding or LS container).

For su, sudo, SSH, Cron processes, the module is built into the Pluggable authentication module (PAM). When a user authenticates to these services, the module also intercepts their process and places it in an LS container.

The cgroups v2 mechanism is used to limit resources.

Features:

• Resource usage control: limit the usage of CPU, physical memory, SWAP file, and the total number of processes
• Out-of-the-box limiting: basic support for  su, sudo, SSH, Cron, Apache and PHP-FPM services
• Monitoring: real-time consumption tracking via active LS containers
• Analytics: view statistics in the dashboard's web interface, via the CLI, or in Prometheus format connector
• Extensibility: support for isolation for other services with PAM

Isolation 

When LimitedFS is initially activated, a skeleton file system structure is created that is shared by all users. A portion of the shared file system required for the correct operation of programs in the user's environment is copied to it in read-only mode. When LimitedFS is enabled, personal data is created for the user.

The module monitors PHP handler processes:

• Apache mod_php, mod_cgid, mod_fcgid modules 
• mod_lsphp — an ispmanager Apache module that allows PHP to run in LSAPI mode
• php-fpm

When a process is launched under a user, the module intercepts it and places it in an isolated environment (Limited File System , LimitedFS , LFS).

For su, sudo, SSH, Cron processes, the module is integrated into the Pluggable Authentication Module (PAM). When a user authenticates to these services, the module also intercepts their process and places it in the isolated LimitedFS environment. 

After this, pivot_root/chroot replaces the root directory for the process with a previously created one.

Features:

• Environment separation: individual  /etc and /tmp directories for each user
• Out-of-the-box isolation: basic support for  su, sudo, SSH, Cron, Apache, and PHP-FPM services
• Individual namespaces (PIDs): users only see their own su, sudo, SSH, Cron, Apache processes (with the mod_fcgid, mod_lsphp modules) and PHP-FPM
• Flexible configuration: the ability to add third-party software to LFS, as well as manage black- and whitelists for files and directories
• Extensibility: support for isolation for other services with PAM

Web server configuration 

Isolation and limiting are available for the following web server configurations:

• Apache MPM-ITK + PHP as an Apache module
• Apache MPM-ITK / Apache MPM-Prefork + PHP in CGI mode with suEXEC mechanism
• Apache MPM-Prefork + PHP in FastCGI mode (Apache)
• Apache MPM-ITK / Apache MPM-Prefork + PHP in LSAPI mode  (lsphp module)
• Nginx + PHP-FPM (native PHP version and alternative versions 5.3–8.5)

Comparison with CloudLinux

Technical details

Isolation

• Isolation is managed by the lfsctl service
• lfsctl configuration files: /etc/limitedfs/
• lfsctl log: /var/log/limitedfs-service.log
• File systems and mount points for users: /srv/limitedfs/uids/

Limiting

• The following are responsible for limiting resources:
  • klsd — a service that places new processes into LS containers.
  • lsctl — utility that manages limits for containers.
  • ls_admin — utility for additional limiting settings
• klsd service configuration file: /etc/klsd/config
• klsd service log: /var/log/klsd.log

Statistics

• The lsstats.service data collection daemon and data output utilities are responsible for collecting statistics.
• lsstats configuration files: /etc/ls-stats/conf.d/
• lsstats log: /var/log/lsstats-service.log

Active containers

Monitoring of active containers and processes is performed by the lsps utility.