Skip to main content

Handling Web Server file permission: The Last Guide


If you have to work with a LAMP stack one of the first things you do is setting up permission for your user and web server so that you can deploy files correctly and securely and also ina. way that the server can read and execute them.

This often becomes a headache quickly when the two user groups require specific permission sets on specific files to work securely.

The most popular solution

Almost every StackOverflow answer and suggested method will involve giving developers the same user group access as the webserver. Most commonly it's access to www-data . This however comes with it's own set of baggage.
  • If you have several web applications running side-by-side on your web server, you'll have to juggle a lot more with groups and sub-groups just to prevent Developer A to be able to see and modify Application B.
  • When a developer creates a file, the file is owned by the developer, and might not be readable (nor writable if needed) properly by the webserver process. It can be mitigated by careful ACL access. But often does become a hassle
I recently found out about another alternate way to handle permissions which works fine and doesn't have any of these drawbacks.

Solution: The bindfs way

This way ensures a developer could read and write files of an application with its own unshared user / group, while allowing the webserver to have it's own and developer-unscrewable permissions on the files of the said application.

With bindfs, developers access applications via dedicated filesystem mountpoints (placed in their home dir), acting as file-permission filters, presenting files like they're owned by themselves, whereas the files are really owned by the web server user (like www-data)

How to use

This assumes the user is "rabimba" and "HTML" is your folder with webserver
# Installing bindfs (just the first time)
rabimba@e2e-55-141 $ apt-get update 
rabimba@e2e-55-141 $ apt-get -y install bindfs
# Creating the application mountpoint
rabimba@e2e-55-141 $ mkdir -p /home/rabimba/www/html 
rabimba@e2e-55-141 $ chown -Rf rabimba:rabimba /home/rabimb/html 
rabimba@e2e-55-141 $ chmod -Rf 770 /home/rabimba/html
Then, edit the content of /etc/fstab and add this line
bindfs#/var/www/html /home/rabimba/www/html fuse force-user=rabimba,force-group=rabimba,create-for-user=www-data,create-for-group=www-data,create-with-perms=0770,chgrp-ignore,chown-ignore,chmod-ignore 0 0
Save the file, and proceed with mounting application
rabimba@e2e-55-141 $ mount /home/rabimba/www/html
 Now your happy developers can just work in the desktop HTML folder and everything will be automatically reflected in the webserver folder with no permission conflict anymore. Since they both are owned actually by different user groups.

Comments

Post a Comment

Popular posts from this blog

Racecraft (Project Koru) · Prologue — The Origin Story

Racecraft · Prologue , The Origin Story It Started With a Wine List and a Question About Racing How a happy-hour conversation in the Bay Area turned into a trustable AI race coach , and then into a second version that runs entirely on a phone, on the NPU. This is the prologue to a five-part series. Two years ago(1st November, 2024) I was in the Bay Area for a GDE Summit. If you've never been: it's a couple of days of talks among Google Developer Experts, the kind of people who get unreasonably excited about a new on-device runtime, and then , mercifully , a happy hour where everyone stops performing and just eats. We ended up at a restaurant(Puesto Santa Clara), a long table of GDEs, and I was doing the most important engineering of the evening: trying to decide which wine to order. Across the table was Ajeet Mirwani . I don't even remember how the wine talk turned into racing talk , these things drift , but the moment the word "racing" ...
Post a Comment
Read more

A Split‑Brain Neuro‑Symbolic Training Method for High‑Velocity Autonomous Coaching from Telemetry

 Author: Rabimba Karanjai Scope: Problem statement + data methodology + model training (no deployment discussion) Abstract Real‑time coaching in motorsport is a safety‑critical learning problem : a system must map noisy, high‑frequency telemetry to short, actionable guidance that remains physically consistent and avoids hazardous recommendations . This paper proposes a “Split‑Brain” training formulation that separates (i) a semantic coaching target (what action/critique should be expressed) from (ii) a reflexive interface (how actions are represented as compact, verifiable tokens). The approach trains a Small Language Model (SLM) in the Gemma family [1] using QLoRA fine‑tuning [2] , and introduces a telemetry tokenizer plus teacher‑student synthesis pipeline to generate instruction‑action pairs at scale. Core contribution: a reproducible method to convert “ golden lap ” differential tel...
Post a Comment
Read more

The Throughput Trap: Benchmarking vLLM on OpenXLA and the Reality of Production LLM Serving

vLLM Systems · DevLab 2026, Deep Dive I was recently invited by the Google TPU team to speak at the OpenXLA Summer DevLab 2026 . This post breaks down our deep-dive evaluation of the matured vLLM + OpenXLA stack, the fundamental engineering mismatches between CUDA and XLA serving paths, and why traditional capacity metrics are lying to you. If you are operating large language models at enterprise scale right now, your platform architecture team is likely staring at a massive infrastructure crossroads: Should we migrate our core serving workloads from GPUs to TPUs? Historically, NVIDIA's CUDA ecosystem was the only serious option for user-facing, low-latency LLM generation. But here in 2026, the economics and infrastructure options have transformed. Google TPUs are highly available, cheaper per chip, and the open-source serving stack built around vLLM and OpenXLA has officially achieved absolute production readiness. Yet, when our infrast...
Post a Comment
Read more