{"id":22196,"date":"2026-11-07T08:00:00","date_gmt":"2026-11-07T07:00:00","guid":{"rendered":"https:\/\/webhosting.de\/?p=22196"},"modified":"2026-11-05T07:23:24","modified_gmt":"2026-11-05T06:23:24","slug":"cagefs-file-system-isolation-hosting-everyday-life","status":"publish","type":"post","link":"https:\/\/webhosting.de\/en\/cagefs-dateisystem-isolation-hosting-alltag\/","title":{"rendered":"CageFS in Everyday Hosting: File System Isolation Between Customer Accounts"},"content":{"rendered":"<div class=\"wh-article\" data-wh-layout=\"2.1.2\" style=\"width:100%;max-width:820px;margin:0 auto;color:#263b4b;font-family:inherit;font-size:18px;line-height:1.8;text-align:start;overflow-wrap:break-word;box-sizing:border-box\"><p class=\"wh-lead\" style=\"font-size:20px;line-height:1.7;color:#233746;margin:0 0 1.1em\"><strong style=\"font-weight:700;color:inherit\">CageFS restricts the file system view<\/strong> individual users in shared hosting. Processes running within the intended context are assigned their own environment instead of using the full host view. In this way, the CloudLinux component makes it more difficult to snoop on other customer accounts, provided that services and permissions are configured appropriately.  It does not replace resource limits or the security measures for applications and the host. It is therefore crucial for operators to verify the actual execution path; customers can typically only assess their own context.<\/p>\n<nav class=\"wh-toc\" aria-label=\"Contents of this article\" style=\"display:block;margin:28px 0 38px;padding:22px;border:1px solid #d9e4e8;border-radius:14px;background:#f4f8f8\"><p class=\"wh-toc-title\" style=\"font-size:13px;font-weight:700;letter-spacing:.08em;color:#49656b;margin:0 0 14px\">Go directly to the section<\/p><div class=\"wh-toc-grid\" style=\"display:grid;grid-template-columns:repeat(auto-fit,minmax(min(100%,280px),1fr));gap:10px\"><div class=\"wh-toc-item\" style=\"display:block;min-width:0;margin:0;padding:0\"><a class=\"wh-toc-link\" href=\"#shared-hosting-grundlagen\" style=\"display:block;height:100%;padding:12px 15px;border:1px solid #dce6e8;border-radius:9px;background:#fff;color:#18575b;font-size:14px;line-height:1.5;font-weight:600;text-decoration:none;box-sizing:border-box\">Why Hosting Accounts Need Isolation<\/a><\/div>\n<div class=\"wh-toc-item\" style=\"display:block;min-width:0;margin:0;padding:0\"><a class=\"wh-toc-link\" href=\"#skeleton-und-mounts\" style=\"display:block;height:100%;padding:12px 15px;border:1px solid #dce6e8;border-radius:9px;background:#fff;color:#18575b;font-size:14px;line-height:1.5;font-weight:600;text-decoration:none;box-sizing:border-box\">How CageFS Organizes the File System View<\/a><\/div>\n<div class=\"wh-toc-item\" style=\"display:block;min-width:0;margin:0;padding:0\"><a class=\"wh-toc-link\" href=\"#grenzen-und-schichten\" style=\"display:block;height:100%;padding:12px 15px;border:1px solid #dce6e8;border-radius:9px;background:#fff;color:#18575b;font-size:14px;line-height:1.5;font-weight:600;text-decoration:none;box-sizing:border-box\">CageFS, LVE, and Common Risks<\/a><\/div>\n<div class=\"wh-toc-item\" style=\"display:block;min-width:0;margin:0;padding:0\"><a class=\"wh-toc-link\" href=\"#konten-und-websites\" style=\"display:block;height:100%;padding:12px 15px;border:1px solid #dce6e8;border-radius:9px;background:#fff;color:#18575b;font-size:14px;line-height:1.5;font-weight:600;text-decoration:none;box-sizing:border-box\">Consider Accounts and Websites Separately<\/a><\/div>\n<div class=\"wh-toc-item\" style=\"display:block;min-width:0;margin:0;padding:0\"><a class=\"wh-toc-link\" href=\"#pilot-und-status\" style=\"display:block;height:100%;padding:12px 15px;border:1px solid #dce6e8;border-radius:9px;background:#fff;color:#18575b;font-size:14px;line-height:1.5;font-weight:600;text-decoration:none;box-sizing:border-box\">Check Pilot and CageFS Status<\/a><\/div>\n<div class=\"wh-toc-item\" style=\"display:block;min-width:0;margin:0;padding:0\"><a class=\"wh-toc-link\" href=\"#isolation-vergleichen\" style=\"display:block;height:100%;padding:12px 15px;border:1px solid #dce6e8;border-radius:9px;background:#fff;color:#18575b;font-size:14px;line-height:1.5;font-weight:600;text-decoration:none;box-sizing:border-box\">A Comparison of Protection Strategies<\/a><\/div>\n<div class=\"wh-toc-item\" style=\"display:block;min-width:0;margin:0;padding:0\"><a class=\"wh-toc-link\" href=\"#ausfuehrungspfade-pruefen\" style=\"display:block;height:100%;padding:12px 15px;border:1px solid #dce6e8;border-radius:9px;background:#fff;color:#18575b;font-size:14px;line-height:1.5;font-weight:600;text-decoration:none;box-sizing:border-box\">Testing Execution Paths in a Controlled Manner<\/a><\/div>\n<div class=\"wh-toc-item\" style=\"display:block;min-width:0;margin:0;padding:0\"><a class=\"wh-toc-link\" href=\"#werkzeuge-und-wartung\" style=\"display:block;height:100%;padding:12px 15px;border:1px solid #dce6e8;border-radius:9px;background:#fff;color:#18575b;font-size:14px;line-height:1.5;font-weight:600;text-decoration:none;box-sizing:border-box\">Missing Tools and Skeleton Maintenance<\/a><\/div>\n<div class=\"wh-toc-item\" style=\"display:block;min-width:0;margin:0;padding:0\"><a class=\"wh-toc-link\" href=\"#betrieb-und-entscheidung\" style=\"display:block;height:100%;padding:12px 15px;border:1px solid #dce6e8;border-radius:9px;background:#fff;color:#18575b;font-size:14px;line-height:1.5;font-weight:600;text-decoration:none;box-sizing:border-box\">Operate Safely and Make Informed Decisions<\/a><\/div>\n<\/div><\/nav><section class=\"wh-section\" aria-labelledby=\"shared-hosting-grundlagen\" style=\"display:block;margin:0 0 36px;min-width:0\"><h2 id=\"shared-hosting-grundlagen\" style=\"margin:38px 0 18px;color:#172f41;font-size:clamp(24px,1.25rem + 1vw,30px);font-weight:700;line-height:1.3;scroll-margin-top:115px\">Why Hosting Accounts Need Isolation<\/h2><p style=\"margin:0 0 1.1em;font-size:inherit;line-height:inherit\">With shared hosting, multiple customers run their websites on the same server. If a script in Account A is compromised, it may attempt to gather information about the environment and access files in other accounts. This may include configuration files containing login credentials or personal data. The separation of accounts is intended to make such access more difficult, even though the infrastructure is shared.<\/p>\n<p style=\"margin:0 0 1.1em;font-size:inherit;line-height:inherit\">These include <strong style=\"font-weight:700;color:inherit\">Visibility and Access Rights<\/strong> Different issues. A directory name may be visible even though file permissions prevent its contents from being read. Conversely, a restricted view alone is not a substitute for carefully configured permissions: Anything that is accessible within the environment must still be adequately protected.<\/p>\n<p style=\"margin:0 0 1.1em;font-size:inherit;line-height:inherit\"><strong style=\"font-weight:700;color:inherit\">CageFS<\/strong> adds a user-specific file system environment to the permissions. A process running in the designated context does not simply have the same view of the host as an administrator. This is intended to prevent a script running under Account A from easily exploring directories belonging to other accounts. Which areas are actually visible depends on the configuration. <\/p>\n<p style=\"margin:0 0 1.1em;font-size:inherit;line-height:inherit\">For operators, this is an additional <strong style=\"font-weight:700;color:inherit\">Separating layer<\/strong>, no guarantee against any impact on other customers. Errors in shared services, overly broad permissions, or incomplete service integration can affect the level of protection. Therefore, isolation must be verified where customer programs are actually running, and not merely based on a setting in the administration console.<\/p>\n<p style=\"margin:0 0 1.1em;font-size:inherit;line-height:inherit\">For hosting customers, this distinction is also important: The fact that a user\u2019s own application cannot see a third-party directory merely describes its specific execution context. It does not prove the configuration of all services or the protection of all other accounts. The provider remains responsible for overall setup and control.<\/p>\n<\/section><section class=\"wh-section\" aria-labelledby=\"skeleton-und-mounts\" style=\"display:block;margin:0 0 36px;min-width:0\"><h2 id=\"skeleton-und-mounts\" style=\"margin:38px 0 18px;color:#172f41;font-size:clamp(24px,1.25rem + 1vw,30px);font-weight:700;line-height:1.3;scroll-margin-top:115px\">How CageFS Organizes the File System View<\/h2><p style=\"margin:0 0 1.1em;font-size:inherit;line-height:inherit\">CageFS provides users with their own view of the file system. It is based on the <strong style=\"font-weight:700;color:inherit\">Skeleton<\/strong>: a template containing files and directories that are made available for the respective environment. The necessary components are included; the user's own home directory is also integrated into their environment. The visible directory tree is therefore not simply an unmodified copy of the host view. <\/p>\n<p style=\"margin:0 0 1.1em;font-size:inherit;line-height:inherit\">This integration can be illustrated using an example: An administrator installs a program on the host, but a client process cannot find it in its environment. This is not necessarily an installation error. The program may be present on the host without being available to the client in the skeleton or through the designated integrations. <\/p>\n<p style=\"margin:0 0 1.1em;font-size:inherit;line-height:inherit\">Conversely, every additional file made available expands the environment that a process can see. The same applies to a mounted directory. Administrators must therefore weigh the functional requirements against the additional visibility: An application may need a specific tool and its dependencies, but not necessarily an entire directory on the host.<\/p>\n<p style=\"margin:0 0 1.1em;font-size:inherit;line-height:inherit\">The <strong style=\"font-weight:700;color:inherit\">Mount Configuration<\/strong> It helps determine which parts of the file system appear in the environment. However, it does not solely determine whether a process is allowed to read, modify, or execute a visible file. Ownership and permissions, among other factors, remain relevant in this regard. A visible path is therefore not synonymous with permitted write access. <\/p>\n<p style=\"margin:0 0 1.1em;font-size:inherit;line-height:inherit\">Your home directory remains particularly important for day-to-day hosting: that\u2019s where the files for each account are typically stored. This integration allows access within the intended context, while the rest of the view is restricted. However, whether a specific application can access all the necessary files depends on its configuration and the paths that are actually available.<\/p>\n<\/section><section class=\"wh-section\" aria-labelledby=\"grenzen-und-schichten\" style=\"display:block;margin:0 0 36px;min-width:0\"><h2 id=\"grenzen-und-schichten\" style=\"margin:38px 0 18px;color:#172f41;font-size:clamp(24px,1.25rem + 1vw,30px);font-weight:700;line-height:1.3;scroll-margin-top:115px\">CageFS, LVE, and Common Risks<\/h2><p style=\"margin:0 0 1.1em;font-size:inherit;line-height:inherit\">CageFS and LVE address different problems. CageFS shapes a user's view of the file system and execution context; <strong style=\"font-weight:700;color:inherit\">LVE<\/strong> is used to monitor and limit resources such as CPU, memory, and I\/O. A process with restricted file system visibility may still consume resources. Conversely, a resource limit alone does not prevent access to incorrectly shared files.  <\/p>\n<p style=\"margin:0 0 1.1em;font-size:inherit;line-height:inherit\">A hosting control panel serves another purpose: Among other things, it manages accounts and can integrate CloudLinux components. However, simply installing a panel does not guarantee that every web process, every shell, and every scheduled task will run within the intended CageFS context. Administrators must verify the appropriate integration for their specific platform. <\/p>\n<p style=\"margin:0 0 1.1em;font-size:inherit;line-height:inherit\">CageFS does not provide a separate virtual machine for each account. The accounts continue to use a <strong style=\"font-weight:700;color:inherit\">shared kernel<\/strong> and may depend on jointly operated services. A vulnerability or misconfiguration in these shared components therefore remains part of the threat model. File system isolation reduces part of the visible environment, but does not replace host security and maintenance.<\/p>\n<p style=\"margin:0 0 1.1em;font-size:inherit;line-height:inherit\">Risks remain even within a properly isolated account. For example, a vulnerable application may expose its own data; stolen credentials may grant an attacker access within the affected account. CageFS does not correct insecure application code or overly permissive permissions on files accessible within that account.<\/p>\n<p style=\"margin:0 0 1.1em;font-size:inherit;line-height:inherit\">For a robust security strategy, these layers must therefore work together: accounts and services must be properly integrated, file permissions must be controlled, resource limits must be set appropriately, and applications must be kept up to date. The level of protection this provides depends on the actual configuration and the services being run. The name of a single component does not replace this assessment.<\/p>\n<\/section><section class=\"wh-section\" aria-labelledby=\"konten-und-websites\" style=\"display:block;margin:0 0 36px;min-width:0\"><h2 id=\"konten-und-websites\" style=\"margin:38px 0 18px;color:#172f41;font-size:clamp(24px,1.25rem + 1vw,30px);font-weight:700;line-height:1.3;scroll-margin-top:115px\">Consider Accounts and Websites Separately<\/h2><p style=\"margin:0 0 1.1em;font-size:inherit;line-height:inherit\">Having two customer accounts on the same server is different from having two websites within a single account. CageFS provides a user-specific environment, thereby limiting an account's view of the file system. However, this does not mean that every website within that account is assigned its own file system boundary. <\/p>\n<p style=\"margin:0 0 1.1em;font-size:inherit;line-height:inherit\">If an agency runs multiple projects under the same hosting account, their applications may access files from other projects, depending on the execution context and permissions. If an attacker gains access to a website through a vulnerable plugin, it is therefore necessary to check which configuration files and login credentials are accessible under that account. The fact that it is separated from a second customer account does not answer this question.<\/p>\n<p style=\"margin:0 0 1.1em;font-size:inherit;line-height:inherit\">For a finer <strong style=\"font-weight:700;color:inherit\">Website Separation<\/strong> CloudLinux documents additional domain-based file system isolation with CloudLinux Isolates. Whether this feature is available depends on the specific product availability, version, and control panel integration. Check these requirements for your own hosting stack instead of assuming that domains are isolated based solely on CageFS activation. <\/p>\n<figure class=\"wp-block-image size-large wh-figure\" aria-describedby=\"wh-caption-detail2\" style=\"display:block;float:none;clear:both;width:100%;max-width:760px;margin:34px auto 40px;border:1px solid #dae5e9;border-radius:14px;overflow:hidden;background:#f5f8fa;box-shadow:0 10px 28px -17px rgba(24,47,60,.28);box-sizing:border-box\"><div class=\"wh-figure-media\" style=\"display:block;background:#eef3f5;line-height:0\"><img loading=\"lazy\" width=\"800\" height=\"534\" src=\"https:\/\/webhosting.de\/wp-content\/uploads\/2026\/11\/cagefs-konto-websites-illustration-449cc474-detail2-ac892f8069-1024x683.webp\" class=\"wp-image-22200\" alt=\"AI-generated illustrations of individual website icons within a shared account limit\" decoding=\"async\" srcset=\"https:\/\/webhosting.de\/wp-content\/uploads\/2026\/11\/cagefs-konto-websites-illustration-449cc474-detail2-ac892f8069-1024x683.webp 1024w, https:\/\/webhosting.de\/wp-content\/uploads\/2026\/11\/cagefs-konto-websites-illustration-449cc474-detail2-ac892f8069-300x200.webp 300w, https:\/\/webhosting.de\/wp-content\/uploads\/2026\/11\/cagefs-konto-websites-illustration-449cc474-detail2-ac892f8069-768x512.webp 768w, https:\/\/webhosting.de\/wp-content\/uploads\/2026\/11\/cagefs-konto-websites-illustration-449cc474-detail2-ac892f8069-18x12.webp 18w, https:\/\/webhosting.de\/wp-content\/uploads\/2026\/11\/cagefs-konto-websites-illustration-449cc474-detail2-ac892f8069.webp 1536w\" sizes=\"auto, (max-width: 800px) 100vw, 800px\" ><\/div><figcaption class=\"wh-caption\" id=\"wh-caption-detail2\" style=\"display:block;margin:0;padding:12px 18px 15px;border-top:1px solid #dce5e9;color:#506575;background:#f5f8fa;font-size:14px;line-height:1.55;text-align:start\">The AI-generated illustration distinguishes between the account limit and any additional limits that may apply across websites.<\/figcaption><\/figure><p style=\"margin:0 0 1.1em;font-size:inherit;line-height:inherit\">Domain-specific LVE limits are also a separate feature with their own requirements. Therefore, an additional filesystem limit does not automatically mean that CPU or memory are limited separately for each domain. The article about <a href=\"https:\/\/webhosting.de\/en\/cloudlinux-site-isolation-a-security-advantage-over-cagefs-hosting\/\">CloudLinux Site Isolation<\/a> clarifies the difference between the account level and the website level; the requirements of the product variant being used remain decisive for setup. <\/p>\n<p style=\"margin:0 0 1.1em;font-size:inherit;line-height:inherit\">When planning, it\u2019s a good idea to start by taking stock: Which sites share an account, which files do they need to share, and which access credentials should remain separate? This will help determine whether separate accounts or domain-based isolation are a better fit for your operational model. Both options require an analysis of the actual usage patterns.<\/p>\n<\/section><section class=\"wh-section\" aria-labelledby=\"pilot-und-status\" style=\"display:block;margin:0 0 36px;min-width:0\"><h2 id=\"pilot-und-status\" style=\"margin:38px 0 18px;color:#172f41;font-size:clamp(24px,1.25rem + 1vw,30px);font-weight:700;line-height:1.3;scroll-margin-top:115px\">Check Pilot and CageFS Status<\/h2><p style=\"margin:0 0 1.1em;font-size:inherit;line-height:inherit\">Before launching a pilot, as the operator, you should verify that the operating system version being used is supported, that the required packages and license are available, and that the control panel is properly integrated. The fact that a control panel is documented as supported does not mean that every feature will work the same way in every combination. Also note which applications and tools the selected test accounts require. <\/p>\n<p style=\"margin:0 0 1.1em;font-size:inherit;line-height:inherit\">Start with explicitly authorized test accounts and a manageable selection of typical applications. Check their home directories, required programs, and relevant execution paths before adding more accounts. For the initial setup, you can use the mode in which CageFS is disabled by default and individual accounts are enabled; alternatively, there is a mode in which CageFS is enabled by default with exceptions. <\/p>\n<p style=\"margin:0 0 1.1em;font-size:inherit;line-height:inherit\">The following read commands are intended for authorized administrators on a system with CageFS installed. <code data-no-translation style=\"font:600 .87em\/1.5 ui-monospace,monospace;color:#235063;background:#edf3f5;border-radius:4px;padding:.1em .3em\">TESTBENUTZER<\/code> Replace this with an existing account that has been approved for testing. The required permissions and the specific output depend on the system; the commands do not change any configuration. <\/p>\n<div class=\"wh-code-window\" data-wh-code style=\"margin:28px 0 34px;border:1px solid #2c4656;border-radius:12px;overflow:hidden;background:#132a3b;box-shadow:0 9px 25px -13px rgba(15,35,55,.2)\"><div class=\"wh-code-toolbar\" style=\"display:flex;flex-wrap:wrap;align-items:center;justify-content:space-between;gap:10px;padding:11px 16px;background:#223e50;color:#edf5fa;font-size:13px;line-height:1.5;font-weight:600\"><span>Terminal<\/span><button type=\"button\" class=\"wh-code-copy\" data-wh-copy hidden style=\"padding:6px 11px;border:1px solid #7893a1;border-radius:6px;background:transparent;color:#fff;font-size:12px;line-height:1.5;font-weight:600;cursor:pointer\">Copy code<\/button><span class=\"wh-copy-status\" aria-live=\"polite\"><\/span><span data-wh-copy-success hidden>Copied<\/span><span data-wh-copy-fallback hidden>Code highlighted\u2014please copy<\/span><\/div><pre class=\"wh-code\" data-no-translation translate=\"no\" style=\"display:block;margin:0;padding:20px;max-width:100%;overflow-x:auto;color:#edf5fa;background:#132a3b;font:14px\/1.75 ui-monospace,SFMono-Regular,Menlo,Consolas,monospace;white-space:pre;direction:ltr;text-align:left\"><code class=\"language-bash\" style=\"font:inherit;color:inherit;background:transparent;padding:0;border:0;white-space:inherit\">\/usr\/sbin\/cagefsctl --cagefs-status\n\/usr\/sbin\/cagefsctl --display-user-mode\n\/usr\/sbin\/cagefsctl --user-status TESTBENUTZER<\/code><\/pre><\/div><p style=\"margin:0 0 1.1em;font-size:inherit;line-height:inherit\">The first command displays the global CageFS status, and the second displays the <strong style=\"font-weight:700;color:inherit\">Operating Mode<\/strong>. The third one checks the status of the selected account. Mode and account status must be considered together: A mode that is enabled by default may have exceptions, while in the other mode, individual accounts are explicitly included.  <\/p>\n<p style=\"margin:0 0 1.1em;font-size:inherit;line-height:inherit\">A positive status message does not necessarily prove that every service is actually running in the intended context. Therefore, document separately what the administration reports and which execution paths were verified using the test account. Only then can a decision be made as to whether the pilot can be expanded to additional accounts and which exceptions are operationally necessary.<\/p>\n<\/section><section class=\"wh-section\" aria-labelledby=\"isolation-vergleichen\" style=\"display:block;margin:0 0 36px;min-width:0\"><h2 id=\"isolation-vergleichen\" style=\"margin:38px 0 18px;color:#172f41;font-size:clamp(24px,1.25rem + 1vw,30px);font-weight:700;line-height:1.3;scroll-margin-top:115px\">A Comparison of Protection Strategies<\/h2><p style=\"margin:0 0 1.1em;font-size:inherit;line-height:inherit\">The approaches differ primarily in terms of where they draw the line and who manages them. The table categorizes their protection objectives; the information on operating costs is qualitative planning guidance, not measured values. Specific requirements depend on the respective platform and its configuration.<\/p>\n<div class=\"wh-table-scroll\" tabindex=\"0\" role=\"region\" aria-label=\"Security Approaches and Key Questions in Hosting\" style=\"width:100%;max-width:100%;overflow-x:auto;margin:28px 0;border:1px solid #dce5e9;border-radius:14px;background:#fff;box-shadow:0 10px 28px -16px rgba(24,47,60,.32);box-sizing:border-box\"><table style=\"width:100%;min-width:580px;border-collapse:separate;border-spacing:0;border:0;margin:0;font-size:15px;line-height:1.6;background:#fff\"><caption style=\"padding:20px;text-align:start;font-size:17px;line-height:1.5;font-weight:700;color:#173246;background:#fff\">Security Approaches and Key Questions in Hosting<\/caption><thead><tr><th scope=\"col\" style=\"padding:15px 18px;border:0;border-bottom:1px solid #e2e9ed;text-align:start;vertical-align:top;white-space:normal;font-size:15px;line-height:1.6;background:#19394d;color:#fff\">Approach<\/th><th scope=\"col\" style=\"padding:15px 18px;border:0;border-bottom:1px solid #e2e9ed;text-align:start;vertical-align:top;white-space:normal;font-size:15px;line-height:1.6;background:#19394d;color:#fff\">Primary Conservation Goal<\/th><th scope=\"col\" style=\"padding:15px 18px;border:0;border-bottom:1px solid #e2e9ed;text-align:start;vertical-align:top;white-space:normal;font-size:15px;line-height:1.6;background:#19394d;color:#fff\">Administrative Unit<\/th><th scope=\"col\" style=\"padding:15px 18px;border:0;border-bottom:1px solid #e2e9ed;text-align:start;vertical-align:top;white-space:normal;font-size:15px;line-height:1.6;background:#19394d;color:#fff\">Shared Dependencies<\/th><th scope=\"col\" style=\"padding:15px 18px;border:0;border-bottom:1px solid #e2e9ed;text-align:start;vertical-align:top;white-space:normal;font-size:15px;line-height:1.6;background:#19394d;color:#fff\">Operating expenses<\/th><th scope=\"col\" style=\"padding:15px 18px;border:0;border-bottom:1px solid #e2e9ed;text-align:start;vertical-align:top;white-space:normal;font-size:15px;line-height:1.6;background:#19394d;color:#fff\">Open-ended exam question<\/th><\/tr><\/thead><tbody><tr><td style=\"padding:15px 18px;border:0;border-bottom:1px solid #e2e9ed;text-align:start;vertical-align:top;white-space:normal;font-size:15px;line-height:1.6;background:#fff;color:#294252\">Linux File Permissions<\/td><td style=\"padding:15px 18px;border:0;border-bottom:1px solid #e2e9ed;text-align:start;vertical-align:top;white-space:normal;font-size:15px;line-height:1.6;background:#fff;color:#294252\">Control File Access Based on Permissions<\/td><td style=\"padding:15px 18px;border:0;border-bottom:1px solid #e2e9ed;text-align:start;vertical-align:top;white-space:normal;font-size:15px;line-height:1.6;background:#fff;color:#294252\">Users and Groups<\/td><td style=\"padding:15px 18px;border:0;border-bottom:1px solid #e2e9ed;text-align:start;vertical-align:top;white-space:normal;font-size:15px;line-height:1.6;background:#fff;color:#294252\">Permissions and Process Context Used<\/td><td style=\"padding:15px 18px;border:0;border-bottom:1px solid #e2e9ed;text-align:start;vertical-align:top;white-space:normal;font-size:15px;line-height:1.6;background:#fff;color:#294252\">Manage Permissions and Groups<\/td><td style=\"padding:15px 18px;border:0;border-bottom:1px solid #e2e9ed;text-align:start;vertical-align:top;white-space:normal;font-size:15px;line-height:1.6;background:#fff;color:#294252\">Which processes are allowed to open which files?<\/td><\/tr><tr><td style=\"padding:15px 18px;border:0;border-bottom:1px solid #e2e9ed;text-align:start;vertical-align:top;white-space:normal;font-size:15px;line-height:1.6;background:#f4f7f9;color:#294252\">CageFS<\/td><td style=\"padding:15px 18px;border:0;border-bottom:1px solid #e2e9ed;text-align:start;vertical-align:top;white-space:normal;font-size:15px;line-height:1.6;background:#f4f7f9;color:#294252\">Restrict User-Specific File System View<\/td><td style=\"padding:15px 18px;border:0;border-bottom:1px solid #e2e9ed;text-align:start;vertical-align:top;white-space:normal;font-size:15px;line-height:1.6;background:#f4f7f9;color:#294252\">Hosting account or user<\/td><td style=\"padding:15px 18px;border:0;border-bottom:1px solid #e2e9ed;text-align:start;vertical-align:top;white-space:normal;font-size:15px;line-height:1.6;background:#f4f7f9;color:#294252\">Host, Services, Mounts, and Permissions<\/td><td style=\"padding:15px 18px;border:0;border-bottom:1px solid #e2e9ed;text-align:start;vertical-align:top;white-space:normal;font-size:15px;line-height:1.6;background:#f4f7f9;color:#294252\">Maintain Skeleton and Service Integration<\/td><td style=\"padding:15px 18px;border:0;border-bottom:1px solid #e2e9ed;text-align:start;vertical-align:top;white-space:normal;font-size:15px;line-height:1.6;background:#f4f7f9;color:#294252\">Are the relevant services running in the Cage?<\/td><\/tr><tr><td style=\"padding:15px 18px;border:0;border-bottom:1px solid #e2e9ed;text-align:start;vertical-align:top;white-space:normal;font-size:15px;line-height:1.6;background:#fff;color:#294252\">CageFS plus LVE<\/td><td style=\"padding:15px 18px;border:0;border-bottom:1px solid #e2e9ed;text-align:start;vertical-align:top;white-space:normal;font-size:15px;line-height:1.6;background:#fff;color:#294252\">Restrict file system visibility and limit resources<\/td><td style=\"padding:15px 18px;border:0;border-bottom:1px solid #e2e9ed;text-align:start;vertical-align:top;white-space:normal;font-size:15px;line-height:1.6;background:#fff;color:#294252\">User or LVE<\/td><td style=\"padding:15px 18px;border:0;border-bottom:1px solid #e2e9ed;text-align:start;vertical-align:top;white-space:normal;font-size:15px;line-height:1.6;background:#fff;color:#294252\">CageFS and LVE Configuration and Service Integration<\/td><td style=\"padding:15px 18px;border:0;border-bottom:1px solid #e2e9ed;text-align:start;vertical-align:top;white-space:normal;font-size:15px;line-height:1.6;background:#fff;color:#294252\">Set and check resource limits<\/td><td style=\"padding:15px 18px;border:0;border-bottom:1px solid #e2e9ed;text-align:start;vertical-align:top;white-space:normal;font-size:15px;line-height:1.6;background:#fff;color:#294252\">Are isolation and execution limits in effect?<\/td><\/tr><tr><td style=\"padding:15px 18px;border:0;border-bottom:1px solid #e2e9ed;text-align:start;vertical-align:top;white-space:normal;font-size:15px;line-height:1.6;background:#f4f7f9;color:#294252\">CloudLinux Isolates<\/td><td style=\"padding:15px 18px;border:0;border-bottom:1px solid #e2e9ed;text-align:start;vertical-align:top;white-space:normal;font-size:15px;line-height:1.6;background:#f4f7f9;color:#294252\">Additional domain-based file system isolation<\/td><td style=\"padding:15px 18px;border:0;border-bottom:1px solid #e2e9ed;text-align:start;vertical-align:top;white-space:normal;font-size:15px;line-height:1.6;background:#f4f7f9;color:#294252\">Domain within an account<\/td><td style=\"padding:15px 18px;border:0;border-bottom:1px solid #e2e9ed;text-align:start;vertical-align:top;white-space:normal;font-size:15px;line-height:1.6;background:#f4f7f9;color:#294252\">Product variant, version, and panel integration<\/td><td style=\"padding:15px 18px;border:0;border-bottom:1px solid #e2e9ed;text-align:start;vertical-align:top;white-space:normal;font-size:15px;line-height:1.6;background:#f4f7f9;color:#294252\">Check Availability and Site Assignment<\/td><td style=\"padding:15px 18px;border:0;border-bottom:1px solid #e2e9ed;text-align:start;vertical-align:top;white-space:normal;font-size:15px;line-height:1.6;background:#f4f7f9;color:#294252\">Which domains are actually included?<\/td><\/tr><tr><td style=\"padding:15px 18px;border:0;border-bottom:1px solid #e2e9ed;text-align:start;vertical-align:top;white-space:normal;font-size:15px;line-height:1.6;background:#fff;color:#294252\">VM or separate server<\/td><td style=\"padding:15px 18px;border:0;border-bottom:1px solid #e2e9ed;text-align:start;vertical-align:top;white-space:normal;font-size:15px;line-height:1.6;background:#fff;color:#294252\">Provide your own system environment or your own hardware<\/td><td style=\"padding:15px 18px;border:0;border-bottom:1px solid #e2e9ed;text-align:start;vertical-align:top;white-space:normal;font-size:15px;line-height:1.6;background:#fff;color:#294252\">VM or Server<\/td><td style=\"padding:15px 18px;border:0;border-bottom:1px solid #e2e9ed;text-align:start;vertical-align:top;white-space:normal;font-size:15px;line-height:1.6;background:#fff;color:#294252\">For a VM, specifically a virtualization platform; for both, their own system administration<\/td><td style=\"padding:15px 18px;border:0;border-bottom:1px solid #e2e9ed;text-align:start;vertical-align:top;white-space:normal;font-size:15px;line-height:1.6;background:#fff;color:#294252\">Operate and update your own system<\/td><td style=\"padding:15px 18px;border:0;border-bottom:1px solid #e2e9ed;text-align:start;vertical-align:top;white-space:normal;font-size:15px;line-height:1.6;background:#fff;color:#294252\">Who manages and secures the operating system and services?<\/td><\/tr><\/tbody><\/table><\/div><p style=\"margin:0 0 1.1em;font-size:inherit;line-height:inherit\">File permissions and restricted visibility are not interchangeable concepts: Even a visible path may not be readable, and a shared path must be appropriately secured. CageFS supplements these permissions with a controlled environment. LVE, on the other hand, addresses resource consumption; for joint use, both layers must be properly configured.  <\/p>\n<p style=\"margin:0 0 1.1em;font-size:inherit;line-height:inherit\">A <strong style=\"font-weight:700;color:inherit\">own VM<\/strong> shifts the administrative boundary relative to a user-specific environment: The guest system must be maintained independently and remains dependent on the virtualization platform. A separate server further alters the shared infrastructure. Which option is appropriate depends on the threat model, the required permissions, and the available operational resources.<\/p>\n<p style=\"margin:0 0 1.1em;font-size:inherit;line-height:inherit\">A blanket security ranking would therefore be misleading. For a comparison of other mechanisms and their respective areas of application, the overview of <a href=\"https:\/\/webhosting.de\/en\/process-isolation-hosting-chroot-cagefs-container-jails-security-comparison\/\">Process Isolation in Hosting<\/a>. The key factor is then a detailed review: Which restrictions are intended to prevent which types of access, which services violate them, and who monitors the configuration?<\/p>\n<\/section><section class=\"wh-section\" aria-labelledby=\"ausfuehrungspfade-pruefen\" style=\"display:block;margin:0 0 36px;min-width:0\"><h2 id=\"ausfuehrungspfade-pruefen\" style=\"margin:38px 0 18px;color:#172f41;font-size:clamp(24px,1.25rem + 1vw,30px);font-weight:700;line-height:1.3;scroll-margin-top:115px\">Testing Execution Paths in a Controlled Manner<\/h2><p style=\"margin:0 0 1.1em;font-size:inherit;line-height:inherit\">An activated account does not necessarily mean that every associated process will actually start in CageFS. The decisive factor is the respective <strong style=\"font-weight:700;color:inherit\">Execution Path<\/strong>: SSH login, web servers, and scheduled tasks can use different integrations. Administrators must therefore check for each relevant service how it maps processes to the account and its environment. <\/p>\n<p style=\"margin:0 0 1.1em;font-size:inherit;line-height:inherit\">For a controlled test, the operator sets up an authorized test account and uses only its own, explicitly approved test files. A file within the designated environment can demonstrate whether the expected access works; a file prepared separately outside the designated view is used to test the scope of access. Third-party customer directories are not suitable test material for this purpose.<\/p>\n<p style=\"margin:0 0 1.1em;font-size:inherit;line-height:inherit\">First, use SSH to verify which environment the test account is actually assigned to and whether the intended test files are accessible as expected. Repeat the test using a web application set up for this purpose and a scheduled task. The results may vary if services are integrated differently or run under a different user context. <\/p>\n<p style=\"margin:0 0 1.1em;font-size:inherit;line-height:inherit\">For each attempt, record the service, account, path, and result. A denied access request only demonstrates the observed boundary in this specific context; it does not prove either the correct isolation of all services or the security of the entire host. Conversely, an unexpectedly successful access attempt should be investigated before additional accounts are put into operation.<\/p>\n<p style=\"margin:0 0 1.1em;font-size:inherit;line-height:inherit\">As a hosting customer, you can check your own execution context and shared files. You generally cannot independently verify global CageFS settings, other accounts, or the integration of all services. The provider is responsible for these matters; if you notice any issues, describe the affected service and the specific path to the provider.<\/p>\n<\/section><section class=\"wh-section\" aria-labelledby=\"werkzeuge-und-wartung\" style=\"display:block;margin:0 0 36px;min-width:0\"><h2 id=\"werkzeuge-und-wartung\" style=\"margin:38px 0 18px;color:#172f41;font-size:clamp(24px,1.25rem + 1vw,30px);font-weight:700;line-height:1.3;scroll-margin-top:115px\">Missing Tools and Skeleton Maintenance<\/h2><p style=\"margin:0 0 1.1em;font-size:inherit;line-height:inherit\">If a tool is installed on the host but cannot be found in the customer account, first check the execution context. A command run via SSH may not use the same environment as a web application or a scheduled task. Next, check the search path and the specific error message before assuming that a package is missing.<\/p>\n<p style=\"margin:0 0 1.1em;font-size:inherit;line-height:inherit\">The operator then examines the <strong style=\"font-weight:700;color:inherit\">Skeleton<\/strong> and the mount configuration. The skeleton helps determine which files and directories are made available in CageFS. A program may therefore exist on the host but still be missing from the user-specific environment; required libraries and other dependencies must also be taken into account during provisioning. <\/p>\n<p style=\"margin:0 0 1.1em;font-size:inherit;line-height:inherit\">The practical solution is not to mount large host directories as a precaution. Doing so might make more files visible than are necessary for the task. Instead, the administrator should use the manufacturer's documentation to select the required program files and dependencies and then test whether the tool works in the intended service context. <\/p>\n<figure class=\"wp-block-image size-large wh-figure\" aria-describedby=\"wh-caption-detail1\" style=\"display:block;float:none;clear:both;width:100%;max-width:760px;margin:34px auto 40px;border:1px solid #dae5e9;border-radius:14px;overflow:hidden;background:#f5f8fa;box-shadow:0 10px 28px -17px rgba(24,47,60,.28);box-sizing:border-box\"><div class=\"wh-figure-media\" style=\"display:block;background:#eef3f5;line-height:0\"><img loading=\"lazy\" width=\"800\" height=\"534\" src=\"https:\/\/webhosting.de\/wp-content\/uploads\/2026\/11\/cagefs-werkzeuge-skeleton-symbolbild-449cc474-detail1-7b7e96c543-1024x683.webp\" class=\"wp-image-22199\" alt=\"AI-generated stock image of an open tool bag containing selected tools on a workbench\" decoding=\"async\" srcset=\"https:\/\/webhosting.de\/wp-content\/uploads\/2026\/11\/cagefs-werkzeuge-skeleton-symbolbild-449cc474-detail1-7b7e96c543-1024x683.webp 1024w, https:\/\/webhosting.de\/wp-content\/uploads\/2026\/11\/cagefs-werkzeuge-skeleton-symbolbild-449cc474-detail1-7b7e96c543-300x200.webp 300w, https:\/\/webhosting.de\/wp-content\/uploads\/2026\/11\/cagefs-werkzeuge-skeleton-symbolbild-449cc474-detail1-7b7e96c543-768x512.webp 768w, https:\/\/webhosting.de\/wp-content\/uploads\/2026\/11\/cagefs-werkzeuge-skeleton-symbolbild-449cc474-detail1-7b7e96c543-18x12.webp 18w, https:\/\/webhosting.de\/wp-content\/uploads\/2026\/11\/cagefs-werkzeuge-skeleton-symbolbild-449cc474-detail1-7b7e96c543.webp 1536w\" sizes=\"auto, (max-width: 800px) 100vw, 800px\" ><\/div><figcaption class=\"wh-caption\" id=\"wh-caption-detail1\" style=\"display:block;margin:0;padding:12px 18px 15px;border-top:1px solid #dce5e9;color:#506575;background:#f5f8fa;font-size:14px;line-height:1.55;text-align:start\">The AI-generated stock image represents the targeted provision of necessary tools within the Skeleton.<\/figcaption><\/figure><p style=\"margin:0 0 1.1em;font-size:inherit;line-height:inherit\">To <strong style=\"font-weight:700;color:inherit\">Skeleton Maintenance<\/strong> It is also important to take into account changes to system packages and the Control Panel. CloudLinux documents a periodic update; after certain changes, a forced update may be necessary. It may also be required after an Apache rebuild. This does not mean that the same manual command must be executed after every update. <\/p>\n<p style=\"margin:0 0 1.1em;font-size:inherit;line-height:inherit\">Plan the update according to the platform in use, and then test the affected applications and tools. If an application was working previously but fails after a change, the timing of the package change, the affected service, and the exact error message will help you narrow down the issue. This allows you to distinguish between a deployment issue and an application error.<\/p>\n<\/section><section class=\"wh-section\" aria-labelledby=\"betrieb-und-entscheidung\" style=\"display:block;margin:0 0 36px;min-width:0\"><h2 id=\"betrieb-und-entscheidung\" style=\"margin:38px 0 18px;color:#172f41;font-size:clamp(24px,1.25rem + 1vw,30px);font-weight:700;line-height:1.3;scroll-margin-top:115px\">Operate Safely and Make Informed Decisions<\/h2><p style=\"margin:0 0 1.1em;font-size:inherit;line-height:inherit\">When making an operational decision, it is not enough to simply consider whether CageFS is generally available. The operator must know which accounts and services need to be protected, which programs they require, and who is responsible for integration and maintenance. The restricted file system view complements other security measures; it does not replace secure applications or the protection of access credentials. <\/p>\n<p style=\"margin:0 0 1.1em;font-size:inherit;line-height:inherit\">The following deserve special attention: <strong style=\"font-weight:700;color:inherit\">common areas<\/strong> and additional mounts. CloudLinux describes for <code data-no-translation style=\"font:600 .87em\/1.5 ui-monospace,monospace;color:#235063;background:#edf3f5;border-radius:4px;padding:.1em .3em\">\/dev\/shm<\/code> A shared integration and an isolation option per user. Which option actually applies must be determined based on the specific configuration. Additional mounts should only provide what applications need, because they can expand the visible environment. <\/p>\n<p style=\"margin:0 0 1.1em;font-size:inherit;line-height:inherit\">An error when entering CageFS is also a security concern. Starting with CageFS 7.2.0-1, CloudLinux documents an option that can be used to prevent processes from running in the event of such an error. Check the installed version and the actual setting instead of assuming how this option will behave in a specific hosting environment based solely on its existence. <\/p>\n<p style=\"margin:0 0 1.1em;font-size:inherit;line-height:inherit\">Changes to Skeleton, mounts, or account assignments belong in a coordinated <strong style=\"font-weight:700;color:inherit\">Maintenance Procedures<\/strong>. Take into account any potential remounts, affected applications, and a maintenance window; also document how the change can be reversed in case of problems. Afterward, the relevant execution paths and required tools should be verified again using the designated test accounts. <\/p>\n<p style=\"margin:0 0 1.1em;font-size:inherit;line-height:inherit\">For customers, the key question is what level of isolation the provider actually implements and how it verifies it. Providers, on the other hand, must balance security needs with ongoing effort: An environment that is too permissive can weaken isolation, while one that is too restrictive can hinder necessary applications. Both require careful configuration and regular review.<\/p>\n<\/section><section class=\"wh-sources\" style=\"margin:40px 0 0;padding:24px 0 0;border-top:1px solid #dce5e9;color:#596b7b;font-size:14px;line-height:1.65\"><h2 style=\"margin:38px 0 18px;color:#172f41;font-size:clamp(24px,1.25rem + 1vw,30px);font-weight:700;line-height:1.3;scroll-margin-top:115px\">Sources and Current State of Knowledge<\/h2><p style=\"margin:0 0 1.1em;font-size:inherit;line-height:inherit\">Status of the research: <time datetime=\"2026-11-04\">2026-11-04<\/time><\/p><p style=\"margin:0 0 1.1em;font-size:inherit;line-height:inherit\">This information is based on the provided sections and the list of sources as of the research date of November 4, 2026. Product availability, version, and panel integration should be verified for the respective platform.<\/p><div class=\"wh-source-urls\"><p style=\"margin:0 0 1.1em;font-size:inherit;line-height:inherit\"><span class=\"wh-source-url\" data-no-translation dir=\"ltr\" style=\"overflow-wrap:anywhere;font:12px\/1.6 ui-monospace,monospace;direction:ltr\">https:\/\/docs.cloudlinux.com\/cloudlinuxos\/cloudlinux_os_components\/<\/span><\/p><p style=\"margin:0 0 1.1em;font-size:inherit;line-height:inherit\"><span class=\"wh-source-url\" data-no-translation dir=\"ltr\" style=\"overflow-wrap:anywhere;font:12px\/1.6 ui-monospace,monospace;direction:ltr\">https:\/\/docs.cloudlinux.com\/cloudlinuxos\/limits\/<\/span><\/p><p style=\"margin:0 0 1.1em;font-size:inherit;line-height:inherit\"><span class=\"wh-source-url\" data-no-translation dir=\"ltr\" style=\"overflow-wrap:anywhere;font:12px\/1.6 ui-monospace,monospace;direction:ltr\">https:\/\/docs.cloudlinux.com\/cloudlinuxos\/isolates\/<\/span><\/p><p style=\"margin:0 0 1.1em;font-size:inherit;line-height:inherit\"><span class=\"wh-source-url\" data-no-translation dir=\"ltr\" style=\"overflow-wrap:anywhere;font:12px\/1.6 ui-monospace,monospace;direction:ltr\">https:\/\/docs.cloudlinux.com\/cloudlinuxos\/command-line_tools\/<\/span><\/p><p style=\"margin:0 0 1.1em;font-size:inherit;line-height:inherit\"><span class=\"wh-source-url\" data-no-translation dir=\"ltr\" style=\"overflow-wrap:anywhere;font:12px\/1.6 ui-monospace,monospace;direction:ltr\">https:\/\/docs.cloudlinux.com\/cloudlinuxos\/control_panel_integration\/<\/span><\/p><\/div><\/section><\/div>","protected":false},"excerpt":{"rendered":"<p>CageFS restricts the file system visibility of hosting accounts. Learn how skeleton files and mounts work, what administrators need to check, and what additional security measures are still necessary.<\/p>","protected":false},"author":1,"featured_media":22198,"comment_status":"closed","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"inline_featured_image":false,"footnotes":""},"categories":[794],"tags":[],"class_list":["post-22196","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-sicherheit-computer_und_internet"],"acf":[],"_links":{"self":[{"href":"https:\/\/webhosting.de\/en\/wp-json\/wp\/v2\/posts\/22196","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/webhosting.de\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/webhosting.de\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/webhosting.de\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/webhosting.de\/en\/wp-json\/wp\/v2\/comments?post=22196"}],"version-history":[{"count":2,"href":"https:\/\/webhosting.de\/en\/wp-json\/wp\/v2\/posts\/22196\/revisions"}],"predecessor-version":[{"id":22201,"href":"https:\/\/webhosting.de\/en\/wp-json\/wp\/v2\/posts\/22196\/revisions\/22201"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/webhosting.de\/en\/wp-json\/wp\/v2\/media\/22198"}],"wp:attachment":[{"href":"https:\/\/webhosting.de\/en\/wp-json\/wp\/v2\/media?parent=22196"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/webhosting.de\/en\/wp-json\/wp\/v2\/categories?post=22196"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/webhosting.de\/en\/wp-json\/wp\/v2\/tags?post=22196"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}