title: On Linux do people chroot a Java Web Application or use IPTables and run as non-root?
body: <p>When you run a Java Servlet Container that you would like to serve both static and dynamic content on port 80 you have the classic question of whether to run the server as:</p>
  
  <ol>
  <li>As root in hopefully a chroot jail if you can (haven't gotten this working yet)</li>
  <li>As a non root user and then use IPTables to forward port 80 to some other port (>1024) that the container is running on</li>
  <li>Both: As a non root user, IPTables, and chroot jail.</li>
  </ol>
  
  <p>The problem with opt. 1 is the complexity of chrooting and still the security problems of running root.The problem with opt. 2 is that each Linux distro has a different way of persisting IPTables. Option 3 of course is probably idea but very hard to setup.</p>
  
  <p>Finally every distro has the annoying differences in daemon scripts.</p>
  
  <p>What do people find as the best distro agnostic solution and are there resources to show how to do this?</p>
  
  <p><em>EDIT: I would rather not run Apache in front of the servlet container because the site is mostly dynamic and total memory footprint is important (hosting costs).</em></p>