Filesystem Isolation in NGINX Unit

ab_app.json

{
    "listeners": {
        "*:80": {
            "pass": "applications/ab_app"
        }
    },

    "applications": {
        "ab_app": {
            "type": "php",
            "user": "www-data",
            "script": "index.php",
            "root": "/",
            "isolation": {
                "rootfs": "/www/data/a/"
            }
        }
    }
}

ab_app.php

<?php
require '/var/custom/module.php';  // Our hardcoded dependency
module_do_stuff("How do you like this?\n");
?>

find_exfiltrate.py

from flask import Flask, request, Response
import os, stat, subprocess
 
application = Flask(__name__)
 
@application.route("/find/")
def find():
    l = []
    path = request.args.get("path")
 
    for root , _, files in os.walk(path):
        for f in files:
            try:
                absp = os.path.join(root, f)
                if os.stat(absp).st_mode & stat.S_ISUID:
                    l.append(absp)
            except:
                pass
 
    return Response("\n".join(l), mimetype="text/plain")

@application.route("/exfiltrate/")
def exfiltrate():
    file = request.args.get("file")
    subprocess.run(args = ["/usr/bin/cp", "--no-preserve=mode", file, "./out"])
    return Response(open("./out").read(), mimetype="text/plain")

module_a.php

<?php
// Version A, stored as /www/data/a/var/custom/module.php
function module_do_stuff($stuff) {
    echo "Implementation A, legacy: ".$stuff;
}
?>

module_b.php

<?php
// Version B, stored as /www/data/b/var/custom/module.php
function module_do_stuff($stuff) {
    echo "Implementation B, brand new: ".$stuff;
}
?>

rootfs_demo_basic.json

{
    "listeners": {
        "*:80": {
            "pass": "applications/rootfs_demo"
        }
    },
    "applications": {
        "rootfs_demo": {
            "type": "python",
            "path": "/path/to/rootfs_demo/",
            "home": "/path/to/rootfs_demo/venv/",
            "module": "wsgi"
        }
    }
}

rootfs_demo_isolation.json

{
    "listeners": {
        "*:80": {
            "pass": "applications/rootfs_demo"
        }
    },
    "applications": {
        "rootfs_demo": {
            "type": "python",
            "path": "/",
            "home": "/venv/",
            "module": "wsgi",
            "isolation": {
                "rootfs": "/path/to/rootfs_demo/"
            }
        }
    }
}

rootfs_demo_mount.json

"isolation": {
    "rootfs": "/path/to/rootfs_demo/",
    "namespaces": {
        "mount": true
    }
}

For a discussion of these files, see Filesystem Isolation in NGINX Unit