User and group settings for opcache preload

[rmikalkenas]

Hello, continuing my journey to roadrunner :)

Could someone help to clarify user/group definition best practices for production usage? Should I create a separate user/group in docker image? I think running under root is not the best choice..
As I understand roadrunner runs under the same user/group which started the process (unless changed in config under server.user, server.group), therefore opcache.preload_user value should be exactly the same <- is this correct?

[rustatian]

Hey @rmikalkenas, nice to meet you 👋🏻

Could someone help to clarify user/group definition best practices for production usage?

They are generally the same as for any application. For security purposes, you may use a different user, but you should not handle requests w/o the web-server in front of the RR.

If you use this configuration option (user+group): link, RR will start the underlying PHP processes from the provided user/group, so, child processes won't be able to access the files which are not in the same group or permissions level.

[rmikalkenas]

1. but you should not handle requests w/o the web-server in front of the RR. - why it's not a good choice to not use web server in front of RR, could you elaborate on it? Somehow I thought that one of RR advantages is that you no longer need a webserver (nginx/apache etc.) and RR can stand as a webserver

2. If you use this configuration option (user+group): [link](https://github.com/roadrunner-server/roadrunner/blob/master/.rr.yaml#L53), RR will start the underlying PHP processes from the provided user/group, so, child processes won't be able to access the files which are not in the same group or permissions level. - this is how I'm trying to do:

   • creating a non-root user in a dockerfile: groupadd -g 10001 app && useradd -u 10000 -g app app && chown -R app:app /var/www/app
   • setting server.user: "app" and server.group: "app" config values
   • trying to run rr serve, but end up with error: ERROR container/poller.go:16 vertex got an error {"id": "http.Plugin", "error": "static_pool_allocate_workers: WorkerAllocate: fork/exec /usr/local/bin/php: operation not permitted"}
   • if I remove user and group settings from .rr.yml and run rr serve under app user - then RR works fine

[rustatian]

1. RR is not a web-server and not a replacement for the web-server. RR is an application server. You may use it directly in Kubernetes, for example, but it should not be open to the world. Because every request means, that RR gets the worker, and if you open the RR endpoint to the world, that would be very easy to DDoS your app.
2. In that case, RR should be started from the root. RR then automatically starts your workers from the specified users. I guess in your case, RR also was started from the non-root user.

[rmikalkenas]

1. all clear, in my case it will be run in k8 cluster
2. yes, I started RR from non-root user

appreciate for explanation @rustatian ! Marking discussion as solved

[rmikalkenas]

BTW, is docs repository hidden? I think such info would be helpful for future users. I would be happy to update docs by contributing

[rustatian]

My pleasure 🤝

BTW, is docs repository hidden?

Here you are: https://github.com/spiral/roadrunner-docs
We have plans to move it to the roadrunner-server org ⚡