Operating principle and features

The ispmanager limiting module isolates files and processes and limits the resources of virtual hosting users. The module is an alternative to CloudLinux.

Limiting and isolation can be used together or separately.

Limiting

The module monitors PHP handler processes:

• Apache mod_php, mod_cgid, mod_fcgid modules 
• mod_lsphp — an ispmanager Apache module that allows PHP to run in LSAPI mode
• php-fpm

When a process is launched under a user, the module intercepts it and places it in a limited environment (Limited surrounding or LS container).

For su, sudo, SSH, Cron processes, the module is integrated into the Pluggable authentication module (PAM). When a user authenticates to these services, the module also intercepts their process and places it in the LS container.

Resource limiting within a container is handled by the cgroups v2 mechanism.

Features:

• Resource usage control: limit the usage of CPU, physical memory, SWAP file, and the total number of processes
• Out-of-the-box limiting: basic support for  su, sudo, SSH, Cron, Apache and PHP-FPM services
• Monitoring: real-time consumption tracking via active LS containers
• Analytics: view statistics in the dashboard's web interface, via the CLI, or in Prometheus format connector
• Extensibility: support for isolation for other services with PAM

Isolation 

When LimitedFS is first activated, a "skeleton" is formed that will be shared by future user file systems. A part of the main file system necessary for correct program execution in users' environments is mounted into that "skeleton" in the read-only mode.

When LimitedFS is enabled for the user, a LimitedFS container (Limited File System, LFS) is implemented for them:

• a personal mount namespace is created for the user that inherits the shared "skeleton"
• using the chroot/pivotroot tool, the user root directory is moved into the "skeleton"

• personal user directories are mounted into the new root directory 

  Which personal directories are mounted

  The default directories include:

  • @/var/www/USERNAME/data
  • @/tmp,700
  • @/var/tmp,700
  • @/var/run/screen,777
  • @/var/php/apm/db,777
  • @/var/cache/php-eaccelerator,777

When a process is launched under a user, the module intercepts it and places it in a LimitedFS container.

The module monitors PHP handler processes:

• Apache mod_php, mod_cgid, mod_fcgid modules 
• mod_lsphp — an ispmanager Apache module that allows PHP to run in LSAPI mode
• php-fpm

For su, sudo, SSH, Cron processes, the module is integrated into the Pluggable Authentication Module (PAM). When a user authenticates to these services, the module also intercepts their process and places it in the isolated LimitedFS environment. 

Features:

• Environment separation: individual  /etc and /tmp directories for each user
• Out-of-the-box isolation: basic support for  su, sudo, SSH, Cron, Apache, and PHP-FPM services
• Individual namespaces (PIDs): users only see their own su, sudo, SSH, Cron, Apache processes (with the mod_fcgid, mod_lsphp modules) and PHP-FPM
• Flexible configuration: the ability to add third-party software to LFS, as well as manage black- and whitelists for files and directories
• Extensibility: support for isolation for other services with PAM

Web server configuration 

Isolation and limiting are available for the following web server configurations:

• Apache MPM-ITK + PHP as an Apache module
• Apache MPM-ITK / Apache MPM-Prefork + PHP in CGI mode with suEXEC mechanism
• Apache MPM-Prefork + PHP in FastCGI mode (Apache)
• Apache MPM-ITK / Apache MPM-Prefork + PHP in LSAPI mode  (lsphp module)
• Nginx + PHP-FPM (native PHP version and alternative versions 5.3–8.5)

Comparison with CloudLinux

Technical details

Isolation

• Isolation is managed by the lfsctl service
• lfsctl configuration files: /etc/limitedfs/
• lfsctl log: /var/log/limitedfs-service.log
• File systems and mount points for users: /srv/limitedfs/uids/

Limiting

• The following are responsible for limiting resources:
  • klsd — a service that places new processes into LS containers.
  • lsctl — utility that manages limits for containers.
  • ls_admin — utility for additional limiting settings
• klsd service configuration file: /etc/klsd/config
• klsd service log: /var/log/klsd.log

Statistics

• The lsstats.service data collection daemon and data output utilities are responsible for collecting statistics.
• lsstats configuration files: /etc/ls-stats/conf.d/
• lsstats log: /var/log/lsstats-service.log

Active containers

Monitoring of active containers and processes is performed by the lsps utility.