gunicorn

Reminds me of another “slow client”-related bug in gunicorn: https://github.com/benoitc/gunicorn/issues/3334

I'm hoping so – gunicorn has a long-open pull request that would fix `--reuse-port`, which currently does nothing https://github.com/benoitc/gunicorn/pull/2938

Interesting looks like it might actually be a python bug. Somehow just changing from sys.exit(0) -> os._exit(0) apparently fixes it. "There is a problem with using the sys.exit() in a forked process (child processes or workers) instead of using the os._exit() that is mentioned in python documentation." https://github.com/benoitc/gunicorn/pull/2820 I've always just needed to manually reload the gunicorn async server in development. Super annoying.

> I believe gunicorn with the uvicorn worker class is the recommended production server. Yep for production that works. In development tho I don't think the gunicorn --reload flag works with that worker type. There is an issue open for this at https://github.com/benoitc/gunicorn/issues/2339 and since I last tried about a year ago I guess they have an unofficial "workaround solution" in one of the comments but it involves making a custom class to support reloading but that requires copying in some code into your project and also using different worker types in dev vs prod. I think this is a good example of why I don't default to uvicorn and async in the project with Django 4.1. The whole package of "async everything" isn't ready for prime time in my opinion. It will improve over time but it's a waiting game at this point. Early adapters

I'm glad I'm not the only one wondering this. I found this Quora post (https://www.quora.com/How-do-you-pronounce-gunicorn) as well as this GitHub issue (https://github.com/benoitc/gunicorn/issues/139), and it's clear as mud now.

I ran into this recently, I'm sure many others did too (I'm not the issue poster). https://github.com/eventlet/eventlet/issues/702 https://github.com/benoitc/gunicorn/pull/2581 While the bug does seem pretty critical for websocket users, the patch-version-change ended up breaking any application that uses gunicorn with eventlet (even if you don't use websockets). It feels slightly like my fault, because eventlet has been at v0.x.x for 9 years now. I used to be a bit hesitant about using anything that couldn't declare a version 1.0.0. I guess I've learned my lesson and just won't use any v0 library except in hobby projects now.

For example: https://discuss.tryton.org/t/wsgi-server-choice/2766 https://mail.zope.org/pipermail/zodb-dev/2010-December/01389... https://docs.rhodecode.com/RhodeCode-Enterprise/admin/tuning... https://github.com/benoitc/gunicorn/issues/1045

This is only partially true. The attack exploits a desync between your application and the proxy, so you can vulnerable to this attack even if you are behind a proxy that respects the HTTP spec if your application doesn't. I actually wrote a medium article about this since I fixed the vulnerability in gunicorn [1] a while ago, but I didn't release it (I will and repost here). What you linked to for the AWS ALB is only fixing ONE way to create a desync between the proxy and the server. EDIT: Here is the link to my blog post https://medium.com/@emilefugulin/http-desync-attacks-with-py... [1] https://github.com/benoitc/gunicorn/pull/2181

We had that problem and hacked around it with the Dockerfile instructions below, if you find a better solution that would be great :) --Dockerfile snippet-- # Cloud Run concurrency is assumed to be set to 10 but we don't assume that is exact # See 'https://github.com/benoitc/gunicorn/issues/1801' so disabling concurrency ENV GUNICORN_CMD_ARGS="-c gunicorn_config.py --workers 1 --threads 1 --timeout 120 --preload" CMD [ "gunicorn", "pkg.http:app" ] # Or just use Flask directly if concurrency is set to 1 #CMD [ "python", "cmd/server/main.py" ]

The problem is with some specific features like select.epoll. gevent doesn't support that and will break such code. This includes socketio libraries - we use third party tools like pusher.com and all of them break with python 3. E.g. https://github.com/benoitc/gunicorn/issues/1494 Gevent explicitly says : "Given that epoll is more sophisticated than select or poll (e.g., support for edge triggered and level triggered events), I don't know if we can emulate that close enough with the capabilities that libev exposes (we'd need to pass the stdlib tests when monkey-patched), and I don't know what the performance characteristics would be (and if the subtle differences would break apps) " I don't see a path forward for gevent with these issues in place.

To simplify this process further, you can run both the new and old gunicorn process on the same port using the SO_REUSEPORT feature in Linux 3.9. This way you don't need to listen on a new port and update nginx config (potentially once for each upstream web server). I submitted a patch to gunicorn just this week about this: https://github.com/benoitc/gunicorn/issues/598. Ideally I'd love to see all server software that listens on a port have a SO_REUSEPORT option for hot-swapping. This feature makes operations so much simpler.

gunicorn doesn't have the remapping issues of node and is significantly more verb-agnostic, but it will not handle many valid HTTP verbs: https://github.com/benoitc/gunicorn/blob/master/gunicorn/htt...