We're beginning to allocate sub-accounts in our new Private Atom Cloud on AWS (Linux) to disparate campus units. Anticipating the universal need for SFTP, we would like to somehow mimic a "chroot" to limit sub-account process access to their own "landing zone." Obviously, each sub-account worker is running as the same OS user so we see no way to enforce unique chroots. One solution we're toying with is to provide an SFTP process in an integration pack (one which can determine the sub-account it's executing in and knows not to wander outside its space) and then block developers from creating their own SFTP connector(s) - assuming rules that granular can be defined.
Before going down this route we were wondering if there's documentation we've missed on how to accomplish the fencing we need, or if anyone else out there has developed a solution they'd be willing to share?