I'm switching my production sever to use virtualenv, and I want to understand the best practices for setting up virtualenv in a production environment. The following questions are ones I've run into today while trying to figure this out:

  • what user should I use to create the virtualenv?
  • where should that user put the virtualenv?
  • how do I activate the virtualenv with the permissions of that user?

Virtualenv is going to be used almost exclusively by Apache, so I'm thinking the correct user is www-data, and the location of the virtualenv could be /var/www/.virtualenvs.

That seems OK, but the next problem is that www-data doesn't actually have a login shell and can't write to its own home directory (/var/www/), so when I try to activate the virtualenv, it doesn't work, and when I try to install things using pip, I get errors like:

The directory '/var/www/.cache/pip/http' or its parent directory is not owned by the current user and the cache has been disabled. Please check the permissions and owner of that directory. If executing pip with sudo, you may want sudo's -H flag.

(even if I use -H I get this error.)

So, I could create a login shell for www-data, but that feels like a security anti-pattern.

And I could give www-data access to its home directory (/var/www/), but that's obviously a security anti-pattern.

Is there a norm around this? I've burned WAY too many cycles trying to figure this out, and it feels like it should be much simpler.

  • Did you ever figure this out? – thedouglenz Jul 2 '18 at 17:02
  • Nope, not really. Maybe we need a bounty. – mlissner Jul 2 '18 at 20:48

Running in a virtualenv is no different that any other application. You use a user that has the least amount of privileges necessary to do what the application needs to do.

It would not be advisable to run it as yourself.

  • In practice, then I suppose that becomes www-data? – mlissner Nov 3 '15 at 23:58
  • 1
    And I suppose the next question is where should the virtualenv be placed? – mlissner Nov 4 '15 at 0:03
  • I updated this with more details, in case you know where to go from here. I'm pulling my hair out trying to do something that should be quite simple. – mlissner Nov 4 '15 at 0:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.