My setup:
- In production I'm using one virtual server per one web application shard. Shards are behind load balancer.
- In backstage we run web application + DB on a single virtual server. The backstage is only protected by auth digest for non tester users. The web application is exposed directly.
The web application is served by Go net.http server. The running code is deployed only by our team. We are not exposing a platform to third party users to run their code.
For both setups there is a dedicated, unprivileged, user which runs this application.
Is it worth to use chroot when running web applications?
Should I use any other security tweaks?