FreeBSD jails and Sockets

I'm quite new to freeBSD switching from Linux.

I read about jail, the solution sound great for Server Systems. So my idea for my webserver was to create 3 jails. One jail for mysql, one for nginx and one for php-fpm. Now the jails have to communicate with each other. How do I do that?

Over IP? It would be a big overhead but secure. Here is an example:

• CLIENT
  • -> TCP/IP -> NGINX
  • -> TCP/IP -> PHP-FPM
  • -> TCP/IP -> MYSQL
  • -> TCP/IP -> PHP-FPM
  • -> TCP/IP -> NGINX
  • -> TCP/IP -> CLIENT

With Sockets: That would b开发者_运维知识库e a security los..

• create a directories on the host system
• create a directories in the jails
• merge the directories

Which solution do you use?Or do you have better solutions?

I would not separate php-fpm but it's possible. The overhead for IP communication is not that big these days and not that important considering the processing that the database and php processor need to make is far bigger. Especially since there is no actual wire involved. The packets are routed through the interface via a loopback construct and don't hit the wire.

The advantage of separation is that you can move the jail to another physical machine if need be and moving jails is a breeze.

To clarify why not to move php-fpm in a separate jail is that modifying the website becomes a two-task process for static content (images) and dynamic content (php files). The advantage is that a breach in the webserver software is not able to modify php code. This is also why you should not nullfs your php code onto the webserver jail if you plan to separate as it would defeat it's advantage.

I really don't know if it's the best solution, but if you can use Unix domain sockets you can share a mount between the three jails. The namespace is isolated (they can't create a socket outside the shared mount point) and they should be able to communicate.

To create the shared mount, you can use a nullfs mount. A nice (rather advanced) guide about jails also speaks about nullfs mounts. Of course, this mount point should be used only for the sockets, the other files should stay separate.

Again, I don't know if those applications can communicate over Unix sockets, but if they can you're probably set.