Nginx: Add apk, pxl, ipa to known mime types / download extensions.
Fix PATH.
Protect ~/.drush and other important directories and symlinks on all accounts from changes, plus on sub-accounts from disallowed uploads and from breaking the sites symlink.
Create instance specific tmp directory early enough.
Proc ctrl compatibility with sh wrapper.
If _STRICT_BIN_PERMISSIONS is enabled, use sh wrapper to restrict shell_exec access only to allowed system binaries.

Without this trick one could upload his own versions of protected binaries and call them directly if shell_exec or any similar function is allowed, which in turn would make open_basedir pointless.