Forgive my rudimentary understanding of server security, but one thing I've always struggled with was understanding how to setup
chroot to separate folders (which are discrete WP installations) in a
/var/www directory. There is a lot of conflicting information I've seen that states Apache doesn't support it in virtual hosts, etc. though some seem to recommend it anyway. Generally, I've been confused about how to proceed. I don't want a compromised plugin or WP login from one site allowing attacking scripts access to the larger file system and other websites.
So, at some point I saw a talk on WP development with Docker. It does offer up a lot of workflow advantages, but it would also required we completely rejig our setup. Does containerization help eliminate the need for a
chroot type solution? Does it effectively jail anything (other than exposed ports, I guess) to within its own container? If a single container (and only that single container) was compromised by a malicious script or brute force attack, it is easy enough to spin up a replacement... this isn't mean to be a comprehensive security question as I know using Docker isn't the same as "hardening", but what I'm really wondering is:
In a shared Ubuntu hosting environment, would Docker's containerization help prevent a compromised WordPress site from spreading vs. having them all in
/var/wwwwith some sort of