Ubuntu – How to share /var/www/sites directory on network in ubuntu

So, should www-data user be the owner of /var/www

Why is the apache process run by www-data, but the /var/www owned by root? Is there some risk to making www-data own the folder and run the process?

Your web server is running as www-data. If apache has the ability to write to /var/www and you have configured something incorrectly, or your running a buggy web application, or apache itself has an exploitable bug, then an evil person on the Internet would be able to write things to /var/www. Whenever possible you should always give service accounts the least privileges they need to operate.

is there something even better than the two solutions I've seen?

Create a new group, and change the ownership of the /var/www to root:group. Add all user that need to publish to that folder to the group. You might also want to mark the folder with the setgid bit and adjust the umask of your users so anything they write to this folder will be writable by anyone else in that group.

You should use a group for each website. And make all users that need write access to be members of the respective group.

groupadd site1_com
mkdir /var/www/www.site1.com
chgrp site1_com /var/www/www.site1.com
find /var/www/www.site1.com -type d -print0|xargs -0 chmod g=rwxs
chmod -R g+rw /var/www/www.site1.com
usermod -aG site1_com user1

Now each time the users are creating files under /var/www/www.site1.com folder they should use the umask 0002 (in ~/.bashrc or in the deployment script) or they should set the permission for the group to have read write access chmod -R g+rw /var/www/www.site1.com 2>/dev/null.

Another solution to set the permissions would be to use dnotify. Create /usr/local/sbin/dnotify_handler-reset_perms.sh script with the following content:

#! /bin/sh
CHANGED_FOLDER=$1
find $CHANGED_FOLDER -maxdepth 1 -mmin 0 -not -perm -g+w -exec chmod g+w {} \;

And add to /etc/rc.local:

dnotify --recursive /var/www/www.site1.com --create --execute --background /usr/local/sbin/dnotify_handler-reset_perms.sh