Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Trying to establish a secure multiuser environment with limited user permissions and automated deployment. The example has been made simple to express the idea.

Docroot: /var/www/site/staging/current/public
Deploy user site-staging:staging
Home directory: /home/site-staging

The deploy tool creates two directories - releases and current. Current is a sym link to a releases subdirectory which changes on every site update.

Current is then mount -a to the document root which actually mounts the release directory since you can't mount a symlink.

/var/www/site/staging/current /home/site-staging/current none rw,bind

Keep in mind the current directory is a symlink and would require a umount and remount everytime the site is deployed / updated.

How can I limit the deploy user to their home directory (chroot) while also automatically mounting the current directory to docroot?

Is that the only option? Is there a better strategy?

share|improve this question
@Gilles do you have any thoughts on this? – csi Jan 15 '14 at 19:30
up vote 1 down vote accepted

You could use your home directory /home/site-staging/current as your docroot. Then every time you deploy and recreate the current symlink toward your release your site will updated.

share|improve this answer
unfortunately the DocumentRoot should be current/public. This allows items in the project to be placed outside the document root. I don't believe the DocRoot can be a symlinked subdirectory like current/public is. Am I wrong on this? This was not shown correctly in the intial question but is updated. – csi Jan 15 '14 at 21:54
I'll test it later but I'm pretty sure that you can set your DocRoot to a subdirectory of a symlink as long as you enable Options FollowSymLinks in your apache config or vhost definition. – typositoire Jan 15 '14 at 22:26
In my setup, the parent 2 levels above DocumentRoot required the Options Symlinks Directive. So <Directory /var/www/site/staging/>Options FollowSymLinks</Directory> – csi Jan 16 '14 at 14:09

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.