Setting permissions for writing to web servers
If your Rails application needs to support the ability to write to a directory on your web server (for example file uploads from users) you will need to ensure that the permissions for that directory are correctly configured or the write process will fail consistently.
Cloud 66 default Linux users and groups
When Cloud 66 configures your servers, we create two Linux users:
nginxwhich handles the front-end
cloud66-userwhich handles the backend
In order to bridge the (intentional) gap between these users, we place them both in the same Linux group called
app_writers - this allows for use cases where a feature needs access to both frontend and backend processes.
nginx user is limited and cannot be escalated to a super user using the
su command. This helps to ensure it cannot be abused by unauthorised public users.
Setting permissions for your writable directory
In order to make a directory writable:
- You need to ensure the directory owner group is
- File permissions must be set to
- Directory permissions should be set to
- The process writing to the directory should run as the
If you’re relying on a third-party library or gem, you will need to adjust its configuration to ensure it creates directories with the correct permissions and does not try to run as an exotic or custom user.