I've been using Apache with suexec and mod_fastcgi. It starts up PHP handlers as the selected system user and listens to request via PIPES (fastcgi protocol). It works well but can't share opcode via many handlers.
I've been investigating php-fpm approach. It's really badly documented. What I can see is that it only runs as TCP fastcgi server, like 127.0.0.1:9999, under selected system user, and Apache has to connect to it using FastCGIExternalServer or fastcgi proxy mod.
What will stop other local users from connecting to 127.0.0.1:9999 and passing their own code to handler that is running as other system user?
That seems totally not secure in shared environment. Am I missing something or what?