# Minimum (Hardened) File Permissions
**URL:** https://meta.discourse.org/t/minimum-hardened-file-permissions/148974
**Category:** Self-hosting
**Tags:** hosting
**Created:** [April 23, 2020, 11:05am UTC](https://meta.discourse.org/t/minimum-hardened-file-permissions/148974 "2020-04-23T11:05:56Z")
**Posts on this page:** 3
**Page:** 1
### Author:  [@maltfield](https://meta.discourse.org/u/maltfield)
#### Post date: [April 23, 2020, 11:05am UTC](https://meta.discourse.org/t/minimum-hardened-file-permissions/148974/1 "2020-04-23T11:05:56Z")
Is there any published guidance for the proper/minimum/hardened file permissions for Discourse?
Specifically, I’m looking for a set of idempotent commands using `chown` and `chmod` to strip the permissions to be as low as possible and only grant them when necessary to the minimum privileged user/group.
I’d like this for both
1. The files/dirs in the `/var/discourse/` dir (and other important dirs) on the Discourse docker host and
2. The files/dirs inside the Discourse docker container, especially the files/dirs inside the web server’s document root
For example, I’d like to make it so all the files/dirs in the Discourse container’s exposed document root:
1. Have 0 world permissions
2. Be read-write (2) to the web server’s user _iff_ write access is required (ie: photo/attachment uploads dir)
3. Be read-only (4) to the web server’s user otherwise
4. Only have execute permission (1) if it’s a dir or is otherwise required for a file
Thank you
---
### Author:  [@maltfield](https://meta.discourse.org/u/maltfield)
#### Post date: [May 18, 2020, 11:18am UTC](https://meta.discourse.org/t/minimum-hardened-file-permissions/148974/2 "2020-05-18T11:18:22Z")
bump. Can the developers please chime-in? This would be very helpful to be documented..
---
### Author:  [@sam](https://meta.discourse.org/u/sam)
#### Post date: [May 21, 2020, 6:12am UTC](https://meta.discourse.org/t/minimum-hardened-file-permissions/148974/3 "2020-05-21T06:12:22Z")
Best I can offer is look at our container web.yml in discourse\_docker it sets permissions up there.
This is off beaten path you will need to experiment.