caker wrote:
Instead of symlinks, you can bind-mount the /web/joe directory into their home dir:
Just a general warning to anyone doing bind mounts (probably not a problem in this case, but...); they can not be done read-only. I wanted to chroot my web server but allow CGI scripts (perl, shell), thus requiring /lib and stuff. So I was going to bind-mount /lib into the chrooted area, so any patches applied to the system would automatically appear in the chroot area. Unfortunately the "ro" option is ignored. I definitely don't want my real /lib to be rw in the chroot area!
So... bind mounts good for rw access; bad for ro access.