A lot of PHP apps allow you to install plugins from within the app itself, without going trough the whole process of deployment. The app has to modify it's own

A lot of PHP apps allow you to install plugins from within the app itself, without going trough the whole process of deployment. The app has to modify it's own code in that scenario. This is independent from programming language. If you allow users to independently install plugins you will allow them to execute third-party code - it's true for all programming languages. I don't know ownCloud, but I would guess they have an option to disable plugin installation. And as I said, if you feel paranoid, you can install PHP apps in docker container: https://doc.owncloud.org/server/10.4/admin_manual/installation/docker/ https://doc.owncloud.org/server/10.4/admin_manual/installati...