FreeBSD jails and Sockets

Question

I'm quite new to freeBSD switching from Linux.

I read about jail, the solution sound great for Server Systems. So my idea for my webserver was to create 3 jails. One jail for mysql, one for nginx and one for php-fpm. Now the jails have to communicate with each other. How do I do that?

Over IP? It would be a big overhead but secure. Here is an example:

• CLIENT
  • -> TCP/IP -> NGINX
  • -> TCP/IP -> PHP-FPM
  • -> TCP/IP -> MYSQL
  • -> TCP/IP -> PHP-FPM
  • -> TCP/IP -> NGINX
  • -> TCP/IP -> CLIENT

With Sockets: That would be a security los..

• create a directories on the host system
• create a directories in the jails
• merge the directories

Which solution do you use?Or do you have better solutions?

Answer 1

I would not separate php-fpm but it's possible. The overhead for IP communication is not that big these days and not that important considering the processing that the database and php processor need to make is far bigger. Especially since there is no actual wire involved. The packets are routed through the interface via a loopback construct and don't hit the wire.

The advantage of separation is that you can move the jail to another physical machine if need be and moving jails is a breeze.

To clarify why not to move php-fpm in a separate jail is that modifying the website becomes a two-task process for static content (images) and dynamic content (php files). The advantage is that a breach in the webserver software is not able to modify php code. This is also why you should not nullfs your php code onto the webserver jail if you plan to separate as it would defeat it's advantage.