There’s good news and bad news.
First the good news. Your solution works very well. Things are set up as expected and I even managed to get roundcube working by changing the setup in the sympl-webmail.conf. I was getting around to suggesting what needs to be put in the config file when the bad news happened.
So the bad news. It seems that the settings are applied when the fpm worker is started and are not re-applied when another website sends pages into the worker.
I have two websites on my test machine… and it was all working well… until I got ‘No input file specified’ in one of them. The error log (which I configured) showed that this was because it was denied access to its files because the ‘open_basedir’ was configured for the other site.
So to prove this - I set fpm to use ‘static’ worker allocation - and gave it one process. I accessed one of the websites, and got the ‘No Input file specified’ message on the other.
The error log is interesting, it was set by Apache in config as part of the PHP_ADMIN_VALUE - and logged to the right file so it’s possible that user settable values are reloaded.
It’s hard to be certain if values set in a .user.ini file is loaded per worker thread or per page being processed. I have one of my sites setting the default charset to ISO-8859-1 in its user.ini and a phpinfo page in each website shows the right setting when the page is loaded - so it seems likely that using this approach is OK for user settable values.
Be good if someone else can verify this too.
However, it really does look as if each vhost needs its own pool, if sandboxing vhosts is wanted.