Per-Tenant Network Policy in One Process: ePHPm's eBPF Thread Tags
Every site on an ePHPm server runs inside the same process, so a normal firewall can't tell them apart. A small eBPF program tags each thread with its site. It keeps sites from reaching each other's local ports for under a microsecond per connection.
In multi-tenant mode ePHPm serves every site in sites_dir from one process. Every
tenant’s PHP runs as the same OS user on the same pool of ZTS threads. A thread that just served blog.example will
serve shop.example a few milliseconds later. That’s the density win. It also means the kernel has no idea which
tenant is behind a given connect(). As far as Linux is concerned it’s all ephpm-web.
