Phusion Blog

Passenger author here. Phusion is excited about the Rails 5.0 release! Rails is one of the most productive web frameworks out there, and 5.0 just makes it even better. We have release various Passenger updates to ensure that Passenger plays well with Rails 5, Action Cable etc: https://blog.phusion.nl/2016/02/18/passenger-5-0-25/ https://www.phusionpassenger.com/library/config/nginx/action_cable_int… However we found a bug in Action Cable yesterday which may cause issues with app servers such as Passenger and Puma. Unfortunately the fix didn't make it into 1.0. I recommend anybody who uses Action Cable to apply our patch locally for now: https://github.com/rails/rails/pull/25615

I forgot to mention, the Phusion guys (who Mitchell mentions in the post and who create the excellent Passenger web server) have created some great assets for Vagrant and Docker: https://github.com/phusion/baseimage-docker https://github.com/phusion/passenger-docker (built on the baseimage above) http://blog.phusion.nl/2013/11/08/docker-friendly-vagrant-boxes/ And regarding role-based containers, Phusion's Hong Lai says: "Wait, I thought Docker is about running a single process in a container? Absolutely not true. Docker runs fine with multiple processes in a container. In fact, there is no technical reason why you should limit yourself to one process - it only makes things harder for you and breaks all kinds of essential system functionality, e.g. syslog. Baseimage-docker encourages multiple processes through the use of runit."

You mean if Passenger runs with the Ruby Enterprise Edition? Passenger leak(ed) memory <2.2.4. http://blog.phusion.nl/ "Along with revamping the Apache module’s I/O routines, we accidentally introduced a memory leak. It leaks about 8 KB of memory per request. Our apologies for this."

If you're using Rails 5 ActionCable and you're not on Passenger, I would recommend upgrading to this release as soon as possible. Phusion[0] and other Rails 5 users[1] found a slow client issue with its implementation that was not protected against by the default app server Puma. We contacted the Rails team early on about this issue and worked closely with them to have this issue solved. Now that 5.0.1 is released we are at liberty to disclose details about this security issue. I've written a blog post[2] on the problem, using OS X network shaping tools and a simple app to demonstrate it. Rails apps running on Passenger were never affected as Passenger implements response buffering for regular requests as well as websockets connections. Note that even popular reverse proxies like Nginx don't perform response buffering for websockets as far as I know, so this is something to be aware of if you're running on other frameworks than Rails as well. [0] GH merge of patch: https://github.com/rails/rails/pull/26646 [1] GH related issue: https://github.com/rails/rails/issues/26409 [2] Blog post: https://blog.phusion.nl/2016/12/21/actioncable-under-stress-protecting…

Phusion co-founder here (creators of the Passenger app server); just wanted to chime in and say that this article resonated a lot with our experiences with VCs and our ventures in open source. Even down to the "lifestyle business" remark. Like OP, I'd encourage first-time founders to talk to VCs when starting out just to get an idea of how they perceive your business. Yes, even if you don't plan on raising. You may walk away learning a thing or two :-) As for RethinkDB; we loved it, and even wrote an article about it a few weeks ago, outlining how it could be awesomely used with Rails 5 [1]. Having tried to bootstrap a company solely around an open source product ourselves as well[2], we can't help but share their pain here a bit. For instance, and I'm just going on what OP has shared about RethinkDBs business model, we tried to build our business solely on support contracts initially too. That didn't work out great for us. And it kind of makes sense if you think about it: the support contract is available in case your software is failing during critical operations, yet your main efforts in product improvements are to minimize those chances. So you may have two conflicting interests, and I think you will find yourself having a hard time satisfying both. Through product improvements, you're basically minimizing the probability that such a support contract is needed. That might make it more enticing to only get the contract whenever you actually really need it, and that…

Actually I'm not sure we are referring to the same thing here. I'm referring to pid1 inside the docker container. systemd does not run inside the container as pid1 very easily. Take a look at this - https://github.com/docker/docker/pull/13525 I think your presentation was about replicating docker functionality using systemd-nspawn...Which pretty cool...But it's not the same as what I'm talking about. I'm referring more generally to production decisions with docker. Also read this https://blog.phusion.nl/2015/01/20/docker-and-the-pid-1-zombie-reaping…

See also the article linked earlier in the comments: https://blog.phusion.nl/2015/01/20/docker-and-the-pid-1-zombie-reaping…

I think they mean this: https://blog.phusion.nl/2015/01/20/docker-and-the-pid-1-zombie-reaping…

The actual reason you really need a proper PID 1 is not explained in this post, but a couple of clicks away at [0]: >[...] the init process must also wait for child processes to terminate, >before terminating itself. >If the init process terminates prematurely then all children are terminated uncleanly by the kernel. 0: https://blog.phusion.nl/2015/01/20/docker-and-the-pid-1-zombie-reaping…

I am not sure if I saw it HN recently, but there is an article by Phusion [1] talking about the init process and how to handle it with Docker. They have a base image, baseimage-docker [2], that is supposed to solve that problem. [1]: https://blog.phusion.nl/2015/01/20/docker-and-the-pid-1-zombie-reaping… [2]: https://phusion.github.io/baseimage-docker/

How about a Phusion Passenger-style "open-core" (aka freemium)? https://blog.phusion.nl/2015/10/30/bootstrapping-a-business-around-ope…

Add support for GPG-signed `btrfs pull` and `btrfs push` and I'm totally sold! I've been working on something similar to this but on top of systemd-nspawn, which already does some stuff for you. systemd-nspawn is nice because I run systemd in all my containers and thus allows me to easily do logging etc. I don't really dig the docker-microservices mantra that much. I just use them as glorified VMs I guess. (And yes, you should run an init system in your containers [0]) [0] - https://blog.phusion.nl/2015/01/20/docker-and-the-pid-1-zombie-reaping…

It's because of Passenger's built-in short-term HTTP cache, which is included in the open-source version. That said, the performance gain from the charts is from caching; it's not going to make your Ruby code run 4x faster. Be sure you read https://blog.phusion.nl/2015/02/09/turbocaching-security-changes/ to make sure you don't accidentally end up serving things from a cache that you intended to not be cached/shared.

The part about inability to speed up authenticated page loads fails to take into consideration things like ESI. If the majority of your page is still the same for logged-in users, but they see some pieces of content personalised for them, breaking them out into individually request-able components means you can let software like Varnish or a CDN rely on it's cache of the main page content, and make a very small (and ideally simple to process on the backend) request for the per-user content. It took me some hunting to find it (no docs for v5 yet apparently) but if your stack already includes a caching layer (e.g. Varnish or a CDN) you may want to disable this extra cache using the config described here: http://blog.phusion.nl/2014/11/25/introducing-phusion-passenger-5-beta…

Well, that depends. Are you running Passenger? http://blog.phusion.nl/2014/09/25/security-advisory-phusion-passenger-… What about the rest of your servers? I can't claim to know that none of mine don't call system() somewhere deep in them.

Agreed, this seems like a case of excessive complexity. I hadn't even heard of "two-way" before, but I don't think an algorithm the paper claims to be "remarkably simple" should require twenty-five pages to describe. "two-way" isn't all that fast either, so I don't see any good reason for its use; in the benchmarks I could find, the simpler BMH easily beats it (and optimised BMH variants go even faster): http://volnitsky.com/project/str_search/benchmark-4.5.1.png http://blog.phusion.nl/2010/12/06/efficient-substring-searching/

"the point of reverse proxying is not performance, it's security." Not true. You absolutely need forking/multiple processes on rails deployments to enable even a small number of concurrent requests. If phusion wasn't forking and load balancing between those running instances, your performance would be far lower. EDIT: See this article from the Passenger folks on tuning a passenger deployment, it should be more clear after reading that how Passenger is dealing with concurrency (by running multiple app instances and load balancing between them): http://blog.phusion.nl/2013/03/12/tuning-phusion-passengers-concurrenc…

See also comments on HN[1] about an "old" post[2] from Hongli Lai (Phusion) about this topic. [1] https://news.ycombinator.com/item?id=5007530 [2] http://blog.phusion.nl/2013/01/04/securing-the-rails-session-secret/

Actually, these guys cost people a whole hell of a lot more time and money than someone breaking into a home probably ever did. Just for starters: http://blog.phusion.nl/2013/05/07/phusion-server-security-report/

http://blog.phusion.nl/2013/01/03/rails-sql-injection-vulnerability-ho… Here are some good and experienced Rails developers who apparently had no idea that Rails would automagically suck in XML and YAML and turn it into symbols instead of strings. Clearly they aren't the only ones who didn't "understand the framework" or we wouldn't have gone a week with the impression that CVE-2012-5664 was only exploitable in specific circumstances.

It also has an engineering analogy in Apache Passenger Global queuing. And this article explains why it works the way it does http://blog.phusion.nl/2008/10/29/phusion-passenger-now-with-global-qu… As an aside: The Fry's Electronics store in my city does this and the line does move at a pretty brisk pace, but I had always thought it a rather odd setup till I read this and made the connection to global queuing in Passenger. fascinating.

That question is unanswered, I'd also like to know. Passenger3 includes a watchdog which can monitor processes like Bluepill: http://blog.phusion.nl/2010/06/18/the-road-to-passenger-3-technology-p… Here is a recent Torqbox (jruby jboss app framebork) benchmark article which also includes a comparison between Unicorn/Bluepill with Passenger3. http://torquebox.org/news/2011/03/14/benchmarking-torquebox-round2/ With a few rails apps under low load, Passenger3/REE/MRI1.9 works ok here. If load increases I'll probably look into possible alternatives and aggressive caching.

I never ran Phusion in production for long because of the issue with blocking when spawning, and now I see it's been fixed: http://blog.phusion.nl/2010/07/29/the-road-to-passenger-3-technology-p… In fact, looking through the site, the changes that make up Phusion 3 are incredible. If it works as advertised, there should be no advantages to running Unicorn or a pack of Mongrels anymore. I can hardly wait to try it out!

Phusion Passenger 3 is going to have a feature similar to that: http://blog.phusion.nl/2010/07/01/the-road-to-passenger-3-technology-p… >Imagine having a directory full of Ruby web apps, e.g. ~/Sites. To deploy an app, just drop your application’s directory into ~/Sites. To undeploy it, remove the application’s directory. The application directory’s name is used as the domain name. No manually signaling the web server for a restart.

Unicorn and thin are both written in ruby with the core being the ragel HTTP parser which was first implemented in mongrel. Thin took that ragel parser and added eventmachine to the mix which made it much faster the mongrel. Unicorn went a step further by leveraging the kernel in such a way that things got even faster. Macournoyer, creator of thin was working on thin-turbo, a rewrite of the thin backend in C but stopped a while back. Passenger I guess because its nginx or apache module has to be C but their focus was never performance, more ease of deployment. Passenger 3 will have performance improvements and they've got benchmarks here http://blog.phusion.nl/2010/06/10/the-road-to-passenger-3-technology-p… but I'm thinking mongrel2 will one up it.

Nice to see scrypt getting discussed: http://blog.phusion.nl/2009/08/13/securely-store-passwords-with-bcrypt…

mod_rails/Phusion Passenger is indeed awesome - getting set up on production was a cinch, and no babysitting has been required at all... it just works. If you use it, consider turning on global queueing for extra special goodness: http://blog.phusion.nl/2008/10/29/phusion-passenger-now-with-global-qu… Docs: http://www.modrails.com/documentation/Users%20guide%20latest.html#Pass… EDIT: (Using with Apache, no experience using nginx)

"Ruby Enterprise Edition" has a copy of the relevant patch here: http://blog.phusion.nl/assets/r8ee-security-patch-20080623.txt [from a quick skim of the patch:] The changes to array.c and string.c look pretty worrying, seems like there are unchecked error conditions that aren't too hard to exploit, possibly allowing buffer overflows in String.... e.g. any code where the attacker could specify the right-hand-side argument to the in-place string concatenation operators (String#concat and String#<<) may be affected. Most string concatenations probably aren't in-place (using String#+ instead), but there's probably at least a handful of in-place string concats in popular packages like Rails.

.. no? Because many of the grsecurity+pax improvements apply to any kernel that runs on a CPU (it provides active protections against certain forms of kernel vulnerabilities caused by bugs). This includes illumos, thus the question is valid. grsecurity is a set of patches for the GNU/Linux kernel. illumos is based on Solaris, so the entire argument about grsecurity is nonsense. illumos uses red zones to prevent buffer overflows, which grsecurity is attempting to address. grsecurity is a commercial product by the way. A single license costs $19,000 USD. Enhanced auditing and process control which grsecurity provides have been part of Solaris, and therefore illumos, since Solaris 10, some even earlier. GNU/Linux is still playing catch-up, and as long as people like myself, Bryan Cantrill, Adam Leventhal and the rest of the former Sun kernel engineers live, it will be playing catch-up forever. My impression about package management being a shit-show on other operating systems is that every single podcast or blog post I read about those operating systems is celebrating that "package management is easy now with pkg" -- while it's actually not IMO as good as certain GNU/Linux package managers. In order for that opinion of yours to actually mean anything, the question is: how many packaging formats do you know to produce packages for? Only then will you be in a position where you would actually be competent to make such a statement, and where your opinion would actually make a…

That doesn't have anything to do with Poettering's quote. PR_SET_CHILD_SUBREAPER moves the ownership of an orphaned process to whichever process was selected rather than the default PID1, and that only works for descendant of the subreaper. The problem pointed by the quote is that normal software doesn't go around checking if it has zombie children and waiting on them, so in a container with random software S set as PID1 and creating subprocesses, zombies may accumulate until resources are exhausted[0]. PR_SET_CHILD_SUBREAPER is a way to cause that problem on a system with a proper init (or to test that your init works properly without needing to boot into it) It's not a new observation: https://blog.phusion.nl/2015/01/20/docker-and-the-pid-1-zombie-reaping… Previous HN discussion: https://news.ycombinator.com/item?id=8916785 [0] by default the limit is 32k processes after which the kernel will simply refuse to create new ones