<commit_before>WHAT
====

This is an effort to run an PHP app in a linux namespace, separated from all other stuff.


TODO
====

 - stderr
 - long running bash in a pty
 - blinking cursor

 - net namespace, need for the listening socket to exit the net namespace (unix/abstract sockets?)
 - pid namespace fails
<commit_msg>the jailed filesystem - kind of explained<commit_after>WHAT
====

This is an effort to run an PHP app in a linux namespace, separated from all other stuff.

As soon as the uwsgi process starts, it will unshare the filesystem (fs) namespace, create a tmpfs filesystem for a
root, bind mount (readonly) /usr, %d/app and %d/static from the app, and create some helpful symlinks.

The structure of the tmpfs root system is:

    /app - readonly bind mount of ./app, the php code is here
    /static - readonly bind mount of ./static, static files go here
    /usr - readonly bind mount of the system /usr
    /bin - symlink to /usr/bin
    /lib - symlink to /usr/lib
    /lib64 - symlink to /usr/lib, needed for 64bit architectures
    /dev - mounted /dev, but can be static too, /dev/null, random, zero are needed perhaps
    /proc - /proc for testing, production could work without it


TODO
====

 - stderr
 - long running bash in a pty
 - blinking cursor

 - net namespace, need for the listening socket to exit the net namespace (unix/abstract sockets?)
 - pid namespace fails

{'fraction_non_alphanumeric': 0.0728051391862955, 'fraction_numerical': 0.0028551034975017845, 'mean_word_length': 3.1479289940828403, 'pattern_counts': {'":': 0, '<': 3, '<?xml version=': 0, '>': 3, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '4242163', 'n_tokens_mistral': 405, 'n_tokens_neox': 384, 'n_words': 209}