Ubuntu – What permissions are needed to write a PID file in /var/run

Are you running your Rails application under Apache via mod_rails/passenger?

You may need to set the user that passenger runs the Rails application with "PassengerDefaultUser". Since you mention www-data, I'm assuming an ubuntu or debian server, so this would probably be a separate vhost file in /etc/apache2/sites-available. Add the line:

PassengerDefaultUser www-data

To the correct vhost file. If you don't know which file, run "sudo apache2 -S" to show the available vhosts in the configuration and pick the file that matches the hostname you access the Rails app.

So, should www-data user be the owner of /var/www

Why is the apache process run by www-data, but the /var/www owned by root? Is there some risk to making www-data own the folder and run the process?

Your web server is running as www-data. If apache has the ability to write to /var/www and you have configured something incorrectly, or your running a buggy web application, or apache itself has an exploitable bug, then an evil person on the Internet would be able to write things to /var/www. Whenever possible you should always give service accounts the least privileges they need to operate.

is there something even better than the two solutions I've seen?

Create a new group, and change the ownership of the /var/www to root:group. Add all user that need to publish to that folder to the group. You might also want to mark the folder with the setgid bit and adjust the umask of your users so anything they write to this folder will be writable by anyone else in that group.