Why run each host as a separate user?

Question

PHP

Good afternoon.
You need to set up a VPS for the studio. I'm just learning Linux, so there were difficulties - I can't choose how to organize the distribution by rights and users.
At first I thought, for greater security, create a user for each site and use apache mpm-itk so that each site works in isolation from the others.
That is, so that from one site there is no access to others. But then I thought, if through the php directive open_basedir to forbid the script to rise above its site, then what could be the danger of using the standard apache user everywhere?
I will also disable dangerous php functions like system , execetc. Perl, Python, FTP, mail and panels are not planned for this server. Question: does mpm-itk
and different users give me something in my case? PS Most of the studio's sites are on their own CMS, but there are also common free ones, there are even old ones, I'm afraid that somewhere there may be some vulnerabilities in PHP. The main thing for me is that one hacked site does not damage others and the system.

Answer 1

You need to set up a VPS for the studio. I'm just learning Linux, so there were difficulties - I can't choose how to organize the distribution by rights and users.

For each project - a separate VDS.

Answer 2

I would try to file all this through docker. The php-fpm service would then enter the containers, and the site files would accordingly be mounted in them.

Answer 3

There is also ruid2, php-fpm. Choose what suits you best. Better yet, ask the administrator to set up the server. The cost will be inexpensive. They'll do it for you in just a couple of hours.
At one time, when he worked as an admin in the studio, by that time Nasalnik had created more than 200 Joomla sites using add-ons and templates and file dumps. This was more scary. Constantly sites from the index took off due to viruses on the site.