Magento on AutoPilot: File Paths and Permissions

This article covers the file layout and ownership/permissions model for a Magento store hosted on AutoPilot.

File structure

Each site lives under /var/www/<domain>/, but Nginx doesn't serve that directory directly. Instead, it serves whatever the live symlink inside it points to — that's the actual web root:

jrc-u0pv-g0r9@jump-leader /var/www/jetrails.cloud $ ls -lah
total 0
drwxrwxr-x 3 jrc-u0pv-g0r9 jetrails 46 Jul 10 13:41 .
drwxrwxr-x 5 jrc-u0pv-g0r9 jetrails 63 Jul 10 14:07 ..
lrwxrwxrwx 1 jrc-u0pv-g0r9 jetrails 25 Jul 10 13:41 live -> ./releases/2026-07-10-001
lrwxrwxrwx 1 jrc-u0pv-g0r9 jetrails 34 Jul 10 13:41 logs -> /mnt/jrc-logs/nginx/jetrails.cloud
drwxrwxr-x 3 jrc-u0pv-g0r9 jetrails 28 Jul 10 13:41 releases

• logs is a symlink to /mnt/jrc-logs/nginx/<domain>, which holds Nginx and PHP-FPM access/error logs. This is separate from Magento's own var/log.
• live is what Nginx actually treats as the Magento root, but what it points to isn't fixed:
  • If using a deployment tool like Deployer, live is typically a symlink to the current release under a releases/ directory (as shown above), and gets repointed to a new release on each deploy.
  • If not using such a tool, live doesn't need to follow that pattern at all. It can be a symlink to any directory structure you prefer, or the symlink can be removed entirely and live can simply be a real directory containing the Magento root.

Either way, whatever live resolves to is what matters — that's where the standard Magento paths (pub/media, var/log, app/etc/env.php, etc.) live.

Site files (including the live release directory) are shared to web nodes over NFS by default on clustered environments. Some environments instead sync code to web nodes via rsync to cut down NFS I/O (Serve Web Files on Root Filesystem), but pub/media, var/log, and app/etc/env.php always remain NFS-shared regardless of sync mode. Keep this in mind when troubleshooting "changes not appearing" or "media/logs missing" symptoms.

Ownership and permissions model

NGINX and PHP-FPM run as the www-data user and group, so any publicly served file must be readable by www-data, and any writable directory (cache, generated code, static assets) must also be writable by www-data.

Standard ownership and permissions for the codebase (Magento, WordPress, & LEMP):

1. Codebase files are owned by <cluster_user>:jetrails (e.g. jrc-3p7i-376i:jetrails).
2. Codebase files carry permissions u=rwX,g=u,o=rX.
3. The www-data user gets rwX on writable directories (var, pub/static, pub/media, generated, var/page_cache).

Setting ownership

sudo chown -R <cluster_user>:jetrails /var/www/<domain>
sudo chmod -R u=rwX,g=u,o=rX /var/www/<domain>

Granting www-data write access

sudo setfacl -L -R -m u:"www-data":rwX -m u:"<cluster_user>":rwX /var/www/<domain>/live/{var,pub/static,pub/media,generated,var/page_cache}
sudo setfacl -dL -R -m u:"www-data":rwX -m u:"<cluster_user>":rwX /var/www/<domain>/live/{var,pub/static,pub/media,generated,var/page_cache}

The -d flag sets default ACLs so newly created files and directories inherit the same permissions.