NK OS-level process isolation for multi-user mode. Team+.
Core rules
- Regular user sites/services forbidden to run as root
- NK creates nodekeeper_group_
system group + random-named user per user - PHP-FPM / Redis / Memcached / Supervisor processes setuid
- Website root_dir owner nk_
:nodekeeper_group_ 0750
Path-traversal protection
path_guard.rs validates against file_root, every file_manager API checks before writing — prevents ../../etc/passwd.