Security and isolation

How TNS Panel keeps customers apart: a UNIX user per client, own PHP-FPM, jailed shell and cron, and a root agent with a closed list of operations.

Used by

Admin (applies to every account)

Plan

Free; resource limits and the WAF need a License

Status

Available

Category

Monitoring and security

What it is

Every client account is its own UNIX user, with its own PHP-FPM master and opcache per PHP version. The home directory can be traversed but not listed, other users' processes are hidden, each client has a private /tmp, and shell sessions and cron jobs run inside a jail built from namespaces. Disk quotas for space and files are enforced by the kernel.

The panel itself is split in two: the API runs without privileges and listens on a UNIX socket only, and a separate root agent accepts a fixed list of operations, validates every argument and re-checks ownership by itself.

What it is for

Hosting many customers on one node so that a compromised site stays inside its own account, and so that the panel is not the way out.

Limits

This is a summary of design decisions, not a certification, and no isolation between customers is absolute. CPU, memory, process and IO limits per client need a License. Administrators and resellers must use a second factor, every action is written to the audit log, and panel updates are signed. The jail for shell and cron fails closed: if it cannot be built, the command does not run.