How should I isolate different customers or applications on a server?
Different domains or directories do not automatically create a security boundary. Isolation requires controls across identities, data, network access and the execution environment. Choose the boundary according to how much you trust each workload and the impact of a compromise.
Before you start
- An inventory of tenants, data ownership, trust levels and shared infrastructure.
Instructions
1. Separate identities and data access
Use distinct application accounts, database credentials and storage permissions for unrelated workloads. Ensure a process for one customer cannot read another customer’s files or secrets. Avoid shared administrator or deployment credentials that would bypass the intended separation.
2. Choose the execution boundary
Containers share a host kernel and require appropriate runtime, capability and filesystem controls. Virtual machines provide a different boundary, while a dedicated host can reduce some shared-infrastructure concerns but still needs application separation within it. Kubernetes namespaces alone also require supporting access and network policies for meaningful tenant isolation.
3. Test the intended restrictions
Use authorised test identities to verify that cross-tenant reads, writes and network connections are denied. Include backups, logs, monitoring and support access in the review, since those systems may contain data from multiple tenants. Recheck boundaries when adding shared services or changing deployment tooling.
Check the result
- Each workload can reach only its authorised data, secrets and services.
- Shared operational tools enforce the same tenant boundaries as the application design.
Troubleshooting
- One application compromise exposes another customer’s files
- Review shared service users, file permissions, mounts and deployment credentials. Separate hostnames cannot compensate for both applications running with unrestricted shared access.
Official references
Use the documentation for your installed version when a flag, service name or platform feature differs.