Why hosting panels should queue server actions, not run them
Running shell commands straight from a web request is a security liability. Here is the safer pattern PanelConfig uses.
It is tempting to let a control panel run a shell command the moment an admin clicks a button. It is also one of the fastest ways to turn a web vulnerability into server compromise.
The risk of direct execution
Any code path that shells out from a web request is a target. A single injection flaw, a missed escape, or a confused-deputy bug can hand an attacker the shell.
Queue, then drain
PanelConfig records server-level work as a job and lets an allowlisted worker drain the queue out of band. The web tier writes an auditable record; it never executes the operation itself.
- The attack surface shrinks to a small, reviewable worker.
- Every action is logged before it runs.
- Operations stay inside the same audit trail as the rest of the panel.
The result is a panel that is easier to secure and easier to explain.