I know this is an old thread, but this type if set up is almost exactly what I am looking for - with one issue. Could there be a way to have this set up be valid on a particular script handler or external app. Essentially: I am looking to do something similar on cloudlinux and cagefs but am not in a position to have all user's on the server run under such a mode. It would however be great to be possible to enable it individually on a particular external app. Now I can create an external app and set a uid/guid, then set this as the php handler but when running under that user it is not in cagefs at all.