title: Why is my PHP7.0-FPM pool not running using it's specified system user?
body: <p>I've done this setup quite often but this time I'm overseeing something surely.</p>
  <h1>Goal</h1>
  <p>Having an Apache 2.4 vhosts using different PHP-FPM pools for each vhost using their own system user within an LXD container.</p>
  <h1>The problem</h1>
  <p>Everything is working fine except that when a file is uploaded, the upload directory must be set on www-data which shouldn't be needed in PHP-FPM.</p>
  <h1>System</h1>
  <p>Ubuntu 16.04 LXD contianer</p>
  <h1>Code</h1>
  <h2>/etc/apache2/conf-enabled/php7.0-fpm.conf</h2>
  <p><div class="snippet" data-lang="js" data-hide="false" data-console="false" data-babel="false">
  <div class="snippet-code">
  <pre class="snippet-code-html lang-html prettyprint-override"><code>root@web1:~# cat /etc/apache2/conf-enabled/php7.0-fpm.conf 
  # Redirect to local php-fpm if mod_php is not available
  &lt;IfModule !mod_php7.c&gt;
      # Enable http authorization headers
      SetEnvIfNoCase ^Authorization$ "(.+)" HTTP_AUTHORIZATION=$1
  
      &lt;FilesMatch ".+\.ph(p[3457]?|t|tml)$"&gt;
          SetHandler "proxy:unix:/run/php/php7.0-fpm.sock|fcgi://localhost"
      &lt;/FilesMatch&gt;
      &lt;FilesMatch ".+\.phps$"&gt;
          # Deny access to raw php sources by default
          # To re-enable it's recommended to enable access to the files
          # only in specific virtual host or directory
          Require all denied
      &lt;/FilesMatch&gt;
      # Deny access to files without filename (e.g. '.php')
      &lt;FilesMatch "^\.ph(p[3457]?|t|tml|ps)$"&gt;
          Require all denied
      &lt;/FilesMatch&gt;
  &lt;/IfModule&gt;</code></pre>
  </div>
  </div>
  </p>
  <h2>/etc/apache2/sites-enabled/hs2.nl.conf</h2>
  <p><div class="snippet" data-lang="js" data-hide="false" data-console="false" data-babel="false">
  <div class="snippet-code">
  <pre class="snippet-code-html lang-html prettyprint-override"><code>root@web1:~# cat /etc/apache2/sites-enabled/hs2.nl.conf 
  &lt;VirtualHost *:80&gt;
    ServerAdmin webmaster@hs2.nl
    ServerName hs2.nl
    ServerAlias www.hs2.nl
    DocumentRoot /var/www/html/hs2.nl/web
    ErrorLog ${APACHE_LOG_DIR}/hs2.nl-error.log
    CustomLog ${APACHE_LOG_DIR}/hs2.nl-access.log combined
    #LogFormat "%h %l %u %t \"%r\" %&gt;s %b %{X-Forwarded-For}i" common
    &lt;Directory /var/www/html/hs2.nl/web&gt;
      Options -Indexes +FollowSymLinks
      AllowOverride All
      Require all granted
    &lt;/Directory&gt;
    &lt;Directory /usr/lib/cgi-bin&gt;
      Require all granted
    &lt;/Directory&gt;
    &lt;IfModule mod_fastcgi.c&gt;
      AddHandler php7-fcgi .php
      Action php7-fcgi /php7-fcgi
      Alias /php7-fcgi /usr/lib/cgi-bin/hs2.nl-fcgi
      FastCgiExternalServer /usr/lib/cgi-bin/hs2.nl-fcgi -socket /var/run/php/hs2.nl-fpm.sock -pass-header Authorization
    &lt;/IfModule&gt;
  &lt;/VirtualHost&gt;</code></pre>
  </div>
  </div>
  </p>
  <h2>/etc/php/7.0/fpm/pool.d/hs2.nl.conf</h2>
  <p><div class="snippet" data-lang="js" data-hide="false" data-console="false" data-babel="false">
  <div class="snippet-code">
  <pre class="snippet-code-html lang-html prettyprint-override"><code>root@web1:~# cat /etc/php/7.0/fpm/pool.d/hs2.nl.conf 
  [hs2.nl]
  user = hs2.nl
  group = hs2.nl
  listen = /var/run/php/hs2.nl-fpm.sock
  listen.owner = hs2.nl
  listen.group = hs2.nl
  prefix = /var/www/html/hs2.nl
  chroot = $prefix
  pm = dynamic
  pm.max_children = 5
  pm.start_servers = 2
  pm.min_spare_servers = 1
  pm.max_spare_servers = 3</code></pre>
  </div>
  </div>
  </p>
  <h2>Directory permissions</h2>
  <p><div class="snippet" data-lang="js" data-hide="false" data-console="false" data-babel="false">
  <div class="snippet-code">
  <pre class="snippet-code-html lang-html prettyprint-override"><code>hs2.nl@web1:~/web/uploads$ ls -ald .
  drwxr-xr-x 2 hs2.nl hs2.nl 2 Oct 26 15:15 .
  hs2.nl@web1:~/web/uploads$ pwd
  /var/www/html/hs2.nl/web/uploads</code></pre>
  </div>
  </div>
  </p>
  <h2>Processes running as their respective user</h2>
  <p><div class="snippet" data-lang="js" data-hide="false" data-console="false" data-babel="false">
  <div class="snippet-code">
  <pre class="snippet-code-html lang-html prettyprint-override"><code>root@web1:~# ps aux | egrep "USER|php-fpm: master|pool hs2.nl"
  USER       PID %CPU %MEM    VSZ   RSS TTY      STAT START   TIME COMMAND
  root     16470  0.0  0.3 365880 20220 ?        Ss   14:55   0:00 php-fpm: master process (/etc/php/7.0/fpm/php-fpm.conf)
  hs2.nl   16479  0.0  0.0 365688  4764 ?        S    14:55   0:00 php-fpm: pool hs2.nl
  hs2.nl   16480  0.0  0.0 365688  4764 ?        S    14:55   0:00 php-fpm: pool hs2.nl</code></pre>
  </div>
  </div>
  </p>
  <h2>phpinfo</h2>
  <p><div class="snippet" data-lang="js" data-hide="false" data-console="false" data-babel="false">
  <div class="snippet-code">
  <pre class="snippet-code-html lang-html prettyprint-override"><code>hs2.nl@web1:~/web$ cat phpinfo.php 
  &lt;?php
  $id = shell_exec(id);
  $whoami = shell_exec(whoami);
  echo "Id: " . $id . "&lt;br /&gt;";
  echo "Who am I?: " . $whoami . "&lt;br /&gt;";
  phpinfo();
  ?&gt;</code></pre>
  </div>
  </div>
  </p>
  <h3>Output</h3>
  <p><div class="snippet" data-lang="js" data-hide="false" data-console="false" data-babel="false">
  <div class="snippet-code">
  <pre class="snippet-code-html lang-html prettyprint-override"><code>Id: uid=33(www-data) gid=33(www-data) groups=33(www-data) 
  Who am I?: www-data </code></pre>
  </div>
  </div>
  </p>
  <h1>Further thoughts</h1>
  <p>I thought it might have something to do with LXD but as it seems all pools run under their own users.</p>
  <p>Edit: to eliminate this theory I've loaded the very same configuration onto a normal KVM virtual machine where I was able to reproduce the problem in exactly the same way so I must've done something wrong in my configuration, it's nothing to do with LXD.</p>