I have multiple websites running on the same server, built with various CMS's and frameworks. I need to completely isolate them. I need this because in the future I want to allow some of my clients to host websites on these server, even some potentially vulnerable code (sites full of outdated wp plugins, et cetera). Since I don't want to take responsibility for clients' code, I have to make sure that the environment is safe and if one of them gets hacked, others run fine and the server itself is not compromised.
What I have now is a very experimental environment with chroot jailed sftp access. The problem is, (and there might be other risk factors too), that all websites are run by the same webserver user, let's say
www-data. So in theory an attack involving uploading malware and executing it from the browser can harm all the websites with code owned by
www-data. Similar ideas come to mind for the system database user (not the user I give to the client, but the user running the mysql process).
What's the best practice to handle this issue? Also, if you have anything, checklists, whatever, don't hesitate to share.