I have some pretty basic questions about I am deploying a Flask application in Gunicorn (19.0-1) on Ubuntu (14.10) in combination with Nginx.
Since this app sits along side to Web2Py, I followed a guide to locking down the website produced by Web2Py and applied the same strategy for my Flask application.
In this example, Gunicorn workers are run as the www-data user, and the files and source in /var/www are locked down by placing making the www-data group the owner and www-data the group.
However, a few points confuse me:
- Although Gunicorn workers run as www-data, the Gunicorn server daemon runs as root. Will this be a cause for concern?
- Searching for Nginx + Gunicorn + Flask leads to sites that recommend running Gunicorn through supervisord rather than as an init.d service. Should I consider switching?
- Since the www-data account is locked down (no shell/no password), where can developers using the VM run their code so that the environment matches production as close as possible?