PHP at Density and Scale

Apr 12, 20143 likes1,588 views

Mixing performance, configurability, density, and security at scale has, historically, been hard with PHP. Early approaches have involved CGIs, suhosin, or multiple Apache instances. Then came PHP-FPM. At Pantheon, we've taken PHP-FPM, integrated it with cgroups, namespaces, and systemd socket activation. We use it to deliver all of our goals at unheard-of densities: thousands and thousands of isolated pools per box. Watch how it's configured and see PHP-FPM pools start real-time to serve different Drupal sites as requests come into a server. All of our tools for this are open-source and usable on your own virtual machines and hardware.

PHP at Density and Scale
How Pantheon sees the future of computing.

About Me
● Four Kitchens
● Drupal.org
● Pressflow
● Pantheon
● systemd

Topics
● Performance
○ Socket activation
○ Automount/autofs
○ cgroups
○ “Customer Experience Monitor”
○ Migration
● Security
○ Users
○ Namespaces
○ Defense-in-depth
○ Non-disruptive fixes

Traditional server sockets: overview
...
nginx
TCP
80
Client
nginx
TCP
81
If you want a service
available, the daemon
has to be running.

Socket activation: overview
systemd
TCP
80
Client
TCP
81
nginxfd=3
Only a socket in
systemd has to run
for service availability.

Socket activation: details
● systemd squats on all listeners
○ Looks for incoming traffic with EPOLL
○ Starts the services/containers on-demand
○ Passes socket to daemon as fd=3
● Not a proxy (same performance)
● No client awareness

Socket activation: Pantheon’s use
● nginx and PHP-FPM
● MariaDB soon
○ Using an alternative now
● Allows 90%+ containers to be idle
● Makes bootup sensible
● Reconfiguration pattern is stop, not restart

Automount/autofs
● Like socket activation for file system mounts
○ Kernel squats on mount path and looks for traffic
○ Brings up file mount lazily
● Used for FuseDAV (Valhalla client)

cgroups
● Many options
○ Pantheon uses CPUShares and BlockIOWeight
● Keeps things fair under contention
○ Kind of like adding purple ropes when people are
queueing

Customer Experience Monitor
● Runs a representative Drupal site on every
container host
● Reports scores to the API and monitoring
● Influences migration and container
placement

Migration
● At density, rebalancing is important
● Keep state lightweight
○ No OS
○ No runtime
● Mutiny: migration as replication + promotion

Isolation for security
● Users
● Namespaces

Defense in depth
● Application
○ Drupal
● Runtime
○ nginx, PHP-FPM, FuseDAV
● Container: “binding” certificate
○ Linux user, namespaces, etc.
● Container host: “endpoint” certificate
○ Only trusted for the containers assigned
● Platform: root certificate

Non-disruptive fixes
● Kernel upgrades via migration
● Rolling daemon and library upgrades
○ Heartbleed

ZeroMQ is a library for message passing between processes using sockets. It provides patterns for common messaging needs like publish-subscribe, request-reply, and push-pull. ZeroMQ supports multiple protocols including TCP and inter-process communication. It aims to be more flexible than traditional messaging systems by allowing decentralized architectures. Examples of projects using ZeroMQ include Mongrel2, a high-performance web server, and Brubeck, a Python web framework.

Introduction to ZeroMQ - eSpace TechTalkMahmoud Said

ØMQ (ZeroMQ) is an open-source library for high-performance asynchronous messaging. It was created by Martin Sústrik and Pieter Hintjens to enable cheaper and faster connections between distributed applications. ØMQ provides common messaging patterns like request-reply, publish-subscribe, and push-pull without a centralized message broker. It has bindings for many languages and can handle millions of messages per second with low latency. The presentation demonstrated ØMQ patterns and use cases, and discussed why it may have been better implemented in C instead of C++.

Zeromq anatomy & jeromqDongmin Yu

ZeroMQ is a messaging library that provides sockets that allow for various communication patterns like publish/subscribe. JeroMQ is a Java implementation of ZeroMQ that provides a compatible API with improved performance using Java NIO and other optimizations. It uses a multithreaded model with worker threads handling I/O and messaging and aims to reduce system calls for operations like receiving and sending data.

Build reliable, traceable, distributed systems with ZeroMQRobin Xiao

ZeroMQ is used to build a distributed system with reliable and traceable communication. It allows exposing code over RPC with minimal modification. Exceptions are properly propagated across services. The system is language agnostic and brokerless. Introspection allows viewing methods and signatures without opening code. Streaming APIs allow continuous updates without timeouts. Tracing helps profile nested calls and identify performance bottlenecks. Security is not implemented but could use SSL or authentication layers.

Distributed app development with nodejs and zeromqRuben Tan

This document discusses using Node.js and ZeroMQ for distributed application development. It defines distributed applications as apps distributed across multiple cloud locations that communicate via a standardized protocol. ZeroMQ is introduced as a socket library that can be used for inter-app communication, with common patterns being push-pull for sending data and req-rep for request-response. Scaling is discussed as adding more app instances for push-pull and adding more rep apps for req-rep. Sample ZeroMQ code in Node.js is also provided.

Breaking the RpiDocker challenge Nicolas De Loof

The document summarizes the efforts of three individuals to break the RPiDocker challenge of running the most Docker containers on a Raspberry Pi 2. They took a methodical approach, measuring performance and automating setup. Key steps included systemd and Docker tuning, using a highly optimized web server, and addressing the RPi2's network namespace limit. Collaboration and sharing ideas helped optimize the process and ultimately run 2499 containers, hitting a Go runtime thread limit. Working around the limit confirmed the ability to run nearly 2740 containers before hitting memory limits.

Network Sniffingbudi rahardjo

This document discusses network sniffing and capturing login credentials in plain text protocols. It describes setting up a telnet server and client to experiment with sniffing username and password information using tcpdump and ngrep tools on the local network. The document recommends trying the same technique on other protocols like FTP, POP, SMTP and exploring more secure replacement protocols due to vulnerabilities in sending plain text credentials over the network.

Rust Is Safe. But Is It Fast?ScyllaDB

Rust promises developers the execution speed of non-managed languages like C++, with the safety guarantees of managed languages like Go. Its fast rise in popularity shows this promise has been largely upheld. However, the situation is a bit muddier for the newer asynchronous extensions. This talk will explore some of the pitfalls that users may face while developing asynchronous Rust applications that have direct consequences in their ability to hit that sweet low p99. We will see how the Glommio asynchronous executor tries to deal with some of those problems, and what the future holds.

Golang getting startedHarshad Patil

Go is a statically-typed, garbage-collected programming language that is fast, supports concurrency, and has built-in support for remote package management. It is well-suited for building network servers and applications with non-blocking I/O. The document provides examples of writing a simple "Hello World" program, building a basic HTTP server, and using goroutines for concurrency. It also outlines how to install Go, set up a development environment, and find additional learning resources.

CPAN Gems From The Far Eastlestrrat

Kolon and TTerse are pluggable template syntax options for XSLATE, a full-featured and fast templating system that is 158 times faster than TT2. XSLATE's website is at http://xslate.org. HTTP::Async is a HTTP client that is 7 times faster than LWP and 4 times faster than HTTP::Lite, making it good for REST APIs but not user agent tasks. Server::Starter is a wrapper that allows hot reloading of network servers by listening on a port and restarting on HUP. DBIx::Class provides a cleaner SQL::Abstract clone that is easier to extend. Test::mysqld and Test::postgresql allow easily bringing up database instances for

High-Performance Networking Using eBPF, XDP, and io_uringScyllaDB

Bryan McCoid discusses using eBPF, XDP, and io_uring for high performance networking. XDP allows programs to process packets in the kernel without loading modules. AF_XDP sockets use eBPF to route packets between kernel and userspace via ring buffers. McCoid is building a Rust runtime called Glommio to interface with these techniques. The runtime integrates with io_uring and allows multiple design patterns for receiving packets from AF_XDP sockets.

AHA-best-msf-interface-everkernelsmith

This is more or less just for fun, but it does allow you to remotely control a metasploit instance, kind of like db_nmap lets you control nmap from msf. Since I wrote this, foundation (I think) rewrote the msfrpcd-bruteforce script, and the msgpack implementation he wrote in pure lua could probably be substituted instead, but I learned a lot doing this and am making slides for what I learned. This was briefed at AHA in "turbo-talk" style. I'll be uploading a more readable version soon

Nous Sommes Cyber - HTB BlueDianaWhitney4

BSides Ottawa 2019 - HTB BlueDianaWhitney4

- Diana Whitney is an IT security specialist who has worked at EWA-Canada since 2015 in their payment assurance lab testing PCI standards. She holds CySA+ and PenTest+ certifications. - An initial Nmap scan was run on 10.10.10.40 to discover open ports and services. This revealed ports 139, 445, 135, and 49152-7 were open, indicating SMB services. - Further Nmap scripts identified the host OS as Windows 7 Pro and its security mode. Scanning all 65535 ports found additional open ports. - Nmap vulnerability scripts detected a positive result for CVE-2017-0143, the EternalBlue SMB exploit. - Searchsploit was used

Zmq in context of openstackYatin Kumbhare

ZeroMQ in PHPJosé Lorenzo Rodríguez Urdaneta

Ømq is an intelligent socket library for messaging that allows for highly flexible messaging patterns between applications. It is fast, fault tolerant, and language agnostic. Common patterns supported by Ømq include request-reply, publish-subscribe, and push-pull. Devices can be used to route messages and act as brokers or balancers to solve problems like load balancing. Ømq offers advantages over traditional solutions when advanced network interactions or high performance is required.

Debugging your varnish instanceVarnish Software

Varnish debugging involves gathering data from tools like varnishgather, varnishlog, and varnishtop to diagnose different types of issues like stability problems, functional bugs, operational performance issues, and capacity limitations. The document provides examples of how to use these tools to debug crashes, trace code execution, examine request headers, monitor hit rates and response times, and analyze backend communication. It emphasizes that debugging requires understanding the problem being experienced and leveraging tools like varnishlog to obtain request details, error codes, and timing information.

Improving monitoring systems Interoperability with OpenMetricsChan Shik Lim

Leveraging zeromq for node.jsRuben Tan

zeromqRajan Bhatt

This document provides an overview of ZeroMQ, an open-source messaging library that provides sockets for various messaging patterns like request-reply, publish-subscribe, and push-pull. It discusses how ZeroMQ implements these patterns without a centralized broker through intelligent message batching and transport. Examples are given of how ZeroMQ is used in production systems and how it compares to brokered messaging systems. The document concludes with discussing other open-source messaging projects.

Lindsay distributed geventzmqRobin Xiao

ZeroMQ provides a simple way to build distributed systems without relying on heavyweight message brokers. It uses a messaging model where messages are atomic and can be routed between applications. ZeroMQ avoids many of the complexities of traditional message queues and makes it easy to implement common distributed patterns like request-reply, publish-subscribe, and routing in a variety of programming languages using simple socket-like APIs.

Creating qmgr and allowing remote authorizationRavi Babu

Practical SystemTAP basics: Perl memory profilingLubomir Rintel

This document provides an overview of the SystemTap dynamic tracing tool. It can trace both kernel and userspace functions and variables. Scripts are written in a powerful scripting language that can inline C code and are compiled into kernel modules. Practical examples are provided, including a Perl memory profiler that traces memory allocations to different Perl packages. Safety features like timeouts help prevent scripts from overloading systems.

ORTC SVC SimulCastJxck Jxck

This document discusses ORTC SimulCast and how it differs from WebRTC 1.0. It explains that ORTC is WebRTC 1.0 plus SimulCast and multi-stream interoperability. It then defines SimulCast and describes AVC and SVC SimulCast approaches. It provides details on SVC including base layers, enhancement layers, parameters like temporal, spatial and quality layers. The document also outlines the changes in the ORTC API compared to the previous PeerConnection API and provides an overview of the new classes-based architecture. It notes that WebRTC NV will merge aspects of ORTC and ends by providing additional resources.

ZeroMQ with NodeJSFernando Sanabria

ØMQ is a messaging library that provides asynchronous message passing between applications using in-memory queues. It works on top of several transports including TCP, IPC, in-memory, and multicast protocols. ØMQ aims for horizontal scalability, network topology awareness, and simplicity in communication patterns. It can be installed from source or packages and has bindings for many languages including Node.js. ØMQ supports common socket types for request/reply, publish/subscribe, and asynchronous messaging patterns.

QUICApache Traffic Server

The document discusses Apache Traffic Server's plans to implement QUIC, including: - Their goal is to start development of a QUIC implementation, with a first draft coming soon. - QUIC is a new protocol that implements improved TCP and TLS over UDP. It includes congestion control and loss detection. - There are 4 QUIC specifications covering the core transport, loss detection, TLS mapping, and HTTP mapping. - They discussed initial prototype issues and a revised design, with milestones including experimental ATS support in 2018.

Overview of ZeroMQpieterh

ØMQ was created to address the need for cheaper and more efficient connectivity between distributed systems as hardware capabilities increased. It is an intelligent socket library that provides various connection patterns for messaging between processes. ØMQ aims to be fast, small, multiplatform, and multilingual. It uses common patterns like request-reply and publish-subscribe to allow processes to communicate simply and efficiently over in-process, inter-process, and network connections. The ØMQ community continues to enhance and support the open source library.

PHP at Density and ScaleDavid Timothy Strauss

This document discusses PHP performance and security at scale on Pantheon. Key topics covered include socket activation to improve performance by starting services on demand, automated file system mounting to lazily load files, and cgroups to control resource usage. Pantheon also uses a customer experience monitor, non-disruptive migrations, and layers of isolation like users and namespaces for security. Demonstrations are provided of socket activation, automated mounting, handling contention with cgroups, and performing a non-disruptive OpenSSL fix.

Cassandra-Powered Distributed DNSDavid Timothy Strauss

The document discusses using Apache Cassandra as a highly available backend for DNS and request routing. It describes Cassandra's data replication capabilities and how its data model can be used to store DNS records in a way that provides for efficient lookups and eventual consistency. Code examples show how to model DNS records in Cassandra, insert, lookup, and delete records, and build a DNS server using Twisted that uses Cassandra as its backend data store.

More Related Content

What's hot (20)

Rust Is Safe. But Is It Fast?ScyllaDB

Golang getting startedHarshad Patil

CPAN Gems From The Far Eastlestrrat

High-Performance Networking Using eBPF, XDP, and io_uringScyllaDB

AHA-best-msf-interface-everkernelsmith

Nous Sommes Cyber - HTB BlueDianaWhitney4

BSides Ottawa 2019 - HTB BlueDianaWhitney4

Zmq in context of openstackYatin Kumbhare

ZeroMQ in PHPJosé Lorenzo Rodríguez Urdaneta

Debugging your varnish instanceVarnish Software

Improving monitoring systems Interoperability with OpenMetricsChan Shik Lim

Leveraging zeromq for node.jsRuben Tan

zeromqRajan Bhatt

Lindsay distributed geventzmqRobin Xiao

Creating qmgr and allowing remote authorizationRavi Babu

Practical SystemTAP basics: Perl memory profilingLubomir Rintel

ORTC SVC SimulCastJxck Jxck

ZeroMQ with NodeJSFernando Sanabria

QUICApache Traffic Server

Overview of ZeroMQpieterh

Rust Is Safe. But Is It Fast?ScyllaDB

Golang getting startedHarshad Patil

CPAN Gems From The Far Eastlestrrat

High-Performance Networking Using eBPF, XDP, and io_uringScyllaDB

AHA-best-msf-interface-everkernelsmith

Nous Sommes Cyber - HTB BlueDianaWhitney4

BSides Ottawa 2019 - HTB BlueDianaWhitney4

Zmq in context of openstackYatin Kumbhare

ZeroMQ in PHPJosé Lorenzo Rodríguez Urdaneta

Debugging your varnish instanceVarnish Software

Improving monitoring systems Interoperability with OpenMetricsChan Shik Lim

Leveraging zeromq for node.jsRuben Tan

zeromqRajan Bhatt

Lindsay distributed geventzmqRobin Xiao

Creating qmgr and allowing remote authorizationRavi Babu

Practical SystemTAP basics: Perl memory profilingLubomir Rintel

ORTC SVC SimulCastJxck Jxck

ZeroMQ with NodeJSFernando Sanabria

QUICApache Traffic Server

Overview of ZeroMQpieterh

Viewers also liked (10)

PHP at Density and ScaleDavid Timothy Strauss

Cassandra-Powered Distributed DNSDavid Timothy Strauss

Don't Build "Death Star" Security - O'Reilly Software Architecture Conference...David Timothy Strauss

How vulnerable are your systems after the first line of defense? Do attackers get a stronger foothold after each compromise? How valuable is the data your systems can leak? “Death Star” security describes a system that relies entirely on an outermost security layer and fails catastrophically when breached. As services multiply, they shouldn’t all run in a single, trusted virtual private cloud. Sharing secrets doesn’t scale either, as systems multiply and partners integrate with your product and users. David Strauss explores security methods strong enough to cross the public Internet, flexible enough to allow new services without altering existing systems, and robust enough to avoid single points of failure. David covers the basics of public key infrastructure (PKI), explaining how PKI uniquely supports security and high availability, and demonstrates how to deploy mutual authentication and encryption across a heterogeneous infrastructure, use capability-based security, and use federated identity to provide a uniform frontend experience while still avoiding monolithic backends. David also explores JSON Web Tokens as a solution to session woes, distributing user data and trust without sharing backend persistence. A good written summary of the key talking points: https://www.infoq.com/news/2016/04/oreilysacon-day-one

Containers > VMsDavid Timothy Strauss

Historically, sharing a Linux server entailed all kinds of untenable compromises. In addition to the security concerns, there was simply no good way to keep one application from hogging resources and messing with the others. The classic “noisy neighbor” problem made shared systems the bargain-basement slums of the Internet, suitable only for small or throwaway projects. Serious use-cases traditionally demanded dedicated systems. Over the past decade virtualization (in conjunction with Moore’s law) has democratized the availability of what amount to dedicated systems, and the result is hundreds of thousands of websites and applications deployed into VPS or cloud instances. It’s a step in the right direction, but still has glaring flaws. Most of these websites are just piles of code sitting on a server somewhere. How did that code got there? How can it can be scaled? Secured? Maintained? It’s anybody’s guess. There simply isn’t enough SysAdmin talent in the world to meet the demands of managing all these apps with anything close to best practices without a better model. Containers are a whole new ballgame. Unlike VMs, you skip the overhead of running an entire OS for every application environment. There’s also no need to provision a whole new machine to have a place to deploy, meaning you can spin up or scale your application with orders of magnitude more speed and accuracy.

Scalable Drupal InfrastructureDavid Timothy Strauss

This document provides an overview of designing and configuring scalable Drupal infrastructure. It discusses load distribution, analyzing traffic patterns, throughput methods, tools for scalability like Apache Solr and Varnish, planning infrastructure goals around redundancy, performance and manageability, and managing the cluster ongoing including deployment, system configuration, and monitoring.

PHP at Density and Scale (Lone Star PHP 2014)David Timothy Strauss

Valhalla at PantheonDavid Timothy Strauss

Effective service and resource management with systemdDavid Timothy Strauss

This document provides an overview of using systemd to manage services effectively. It discusses defining service behavior and types, handling timeouts and failures, tightening security, and automating monitoring and management. The key steps outlined are to define expected behavior, plan for the unexpected, tighten security early, and automate monitoring. Various systemd directives and options are explained for tasks like controlling resources, dependencies, reloading, and failure handling.

Container Security via Monitoring and Orchestration - Container Security SummitDavid Timothy Strauss

Security is a basic requirement of modern applications, and developers are increasingly using containers in their development work. In this presentation, we explore the basic components of secure design (preparation, detection, and containment), how containers facilitate that work today (verification), and how container orchestration ought to support models of the future, especially ones that are hard to roll manually (PKI).

LCache DrupalCon Dublin 2016David Timothy Strauss

Scalable caching in Drupal is broken. Once cache access saturates a network link, the main options are Memcache sharding (which has broken coherency during and after network splits) and Redis clustering (immature in multi-master and as complex as MySQL replication in master/replica modes). We can do better. We can have better performance, scale, and operational simplicity. We just need to take a lesson from multicore processor architectures and their use of L1/L2 caches. Drupal doesn't even need full-scale coherency management; it just needs the cache writes on an earlier request to be guaranteed readable on a later request.

PHP at Density and ScaleDavid Timothy Strauss

Cassandra-Powered Distributed DNSDavid Timothy Strauss

Don't Build "Death Star" Security - O'Reilly Software Architecture Conference...David Timothy Strauss

Containers > VMsDavid Timothy Strauss

Scalable Drupal InfrastructureDavid Timothy Strauss

PHP at Density and Scale (Lone Star PHP 2014)David Timothy Strauss

Valhalla at PantheonDavid Timothy Strauss

Effective service and resource management with systemdDavid Timothy Strauss

Container Security via Monitoring and Orchestration - Container Security SummitDavid Timothy Strauss

LCache DrupalCon Dublin 2016David Timothy Strauss

Similar to PHP at Density and Scale (20)

Socket programming, and openrestyTavish Naruka

This document discusses socket programming and network programming concepts like TCP and UDP. It provides examples of using Netcat and Python for sockets. It also summarizes the architecture of Nginx and Openresty, a framework that embeds Lua in Nginx allowing full web applications to run within the Nginx process for high performance and scalability. Openresty allows accessing and modifying requests and responses with Lua scripts.

Nagios Conference 2014 - Eric Mislivec - Getting Started With Nagios CoreNagios

Improving Kafka at-least-once performance at UberYing Zheng

At Uber, we are seeing an increasing demand for Kafka at-least-once delivery (asks=all). So far, we are running a dedicated at-least-once Kafka cluster with special settings. With a very low workload, the dedicated at-least-once cluster has been working well for more than a year. When trying to allow at-least-once producing on the regular Kafka clusters, the producing performance was the main concern. We spent some effort on this issue in the recent months, and managed to reduce at-least-once producer latency by about 80% with code changes and configuration tuning. When acks=0, these improvements also help increasing Kafka throughput and reducing Kafka end-to-end latency.

Tomcat from a cluster to the cloud on RP3Jean-Frederic Clere

The document discusses moving a Tomcat cluster to the cloud. It describes how Tomcat uses multicast for session replication in a cluster, but this does not work in the cloud. The solution presented uses the Kubernetes API to discover cluster nodes instead of multicast, allowing session replication to function in OpenShift. The architecture includes a DynamicMembershipService that refreshes the node list from a KubernetesMemberProvider accessing the Kubernetes API. This allows a Tomcat cluster to run in OpenShift with external session replication.

NGINX Installation and TuningNGINX, Inc.

You’re ready to make your applications more responsive, scalable, fast and secure. Then it’s time to get started with NGINX. In this webinar, you will learn how to install NGINX from a package or from source onto a Linux host. We’ll then look at some common operating system tunings you could make to ensure your NGINX install is ready for prime time. View full webinar on demand at http://nginx.com/resources/webinars/installing-tuning-nginx/

Netty trainingJackson dos Santos Olveira

Irc how to sept 2012Christie Koehler

This document provides an overview of Internet Relay Chat (IRC) including a brief history, technical details, terminology, instructions for connecting to networks, basic commands, and how to register with NickServ and ChanServ. It outlines what IRC is, how it works, examples of raw IRC messages, explanations of networks, clients, channels, operators, and commands. It also gives guidance on joining channels, sending private messages, setting status, and more.

Guest Agents: Support & ImplementationMirantis

Optimizing Linux ServersDavor Guttierrez

This document discusses optimizing Linux servers. It covers monitoring server performance using tools like top, vmstat and iostat to identify bottlenecks. It also discusses optimizing hardware, software, databases, disk I/O, memory, and network performance. The document provides tips for tuning Linux kernels, Apache, MySQL, OpenLDAP and other software. It emphasizes starting with monitoring to identify issues, making one change at a time, and using benchmark tools to test performance.

haproxy_Load_Balancer.pptxcrezzcrezz

1. Server load balancers distribute traffic across multiple servers to improve availability and scalability. They use algorithms like round-robin to distribute client requests. 2. High availability aims for near 100% uptime by eliminating single points of failure and allowing for graceful degradation. Availability levels like 99.9% mean less than 9 hours of downtime per year. 3. Popular open source load balancers include Nginx, HAProxy, and Envoy. They support layer 4/7 load balancing and algorithms like round-robin, persistence, and health checking of backend servers.

haproxy_Load_Balancer.pdfcrezzcrezz

1. Server load balancers distribute traffic across multiple servers to improve availability and scalability. They use algorithms like round-robin to distribute client requests. 2. High availability aims for near 100% uptime by eliminating single points of failure and allowing for graceful degradation. Availability levels like 99.9% mean less than 9 hours of downtime per year. 3. Popular open source load balancers include Nginx, HAProxy, and Envoy. They support load balancing at the TCP/HTTP layers and features like health checks, SSL termination, and session persistence.

Intro to Multi-WAN - pfSense Hangout April 2014Netgate

This document summarizes a pfSense hangout about multi-WAN configurations. It announces two new hardware platforms for pfSense and discusses the Heartbleed vulnerability in OpenSSL and its impact on pfSense. It then covers the goals and strategies for multi-WAN configurations, including redundancy, bandwidth aggregation, and service segregation. Various multi-WAN configuration examples and demos are provided. Troubleshooting tips are also included.

Netty trainingMarcelo Serpa

This document provides an overview of Netty, an asynchronous event-driven network application framework for Java. It discusses key Netty concepts like the event loop, channels, pipelines and handlers. It also provides examples of building an echo server and client with Netty. Additionally, it mentions several large companies that use Netty in production and open-source projects built with Netty. Finally, it discusses some alternative solutions to Netty like ServiceTalk, Armeria and Reactor Netty that provide additional features on top of the Netty core.

WebCamp 2016: Python. Вячеслав Каковский: Real-time мессенджер на Python. Осо...WebCamp

Доклад построен на опыте разработки платформы реал-тайм мессенджера с характеристиками: * 100 000+ одновременно подключенных пользователей * 100+ серверов * REST API для ботов Структура доклада: * Зачем разрабатывать мессенджер? * Актуальные протоколы обмена сообщениями * Архитектурные подходы к разработке мессенджера * Библиотеки и инструменты * Проблемы и подводные камни

Server fleet management using Camunda by Akhil Ahujacamunda services GmbH

Linkedin has multiple data-centers hosting tens of thousands of servers across them. A large percentage of these servers host our data infrastructure - our distributed data store called Espresso is sizeable amongst them. The fleet of servers contain various hardware components including, but not limited to, SSDs; and hardware has a tendency of failing from time to time. In case of hardware failures the servers need to undergo maintenance which can take a significant amount of time based on type of failure. This creates reduced capacity for that duration and throws an interesting problem of maintaining capacity in the face of multiple failures. This talk covers how LinkedIn uses Camunda wrapped around with several components to achieve hands-off capacity management via multiple workflows, with asynchronous pauses and synchronisation among them. It will also highlight how we achieved seamless integrations with various platforms and components within Linkedin's Infrastructure, and a few best practices that helped us achieve the final state.

WebCamp Ukraine 2016: Instant messenger with Python. Back-end developmentViach Kakovskyi

This document discusses building instant messaging platforms with Python. It covers common messaging protocols like XMPP and WebSocket, how they establish and send messages. It also discusses the life of a messaging platform, including authentication, delivery, parsing, and more. Lessons learned include handling bursty traffic, reconnect storms, and preventing incidents. Python is well-suited for messaging backends but other languages may be better for some tasks.

It gilde 20150209Martin Simons

The CFEngine Roadshow is a multi-platform configuration management training that started in 2007 and is now in its fifth edition. It uses CFEngine to demonstrate how to automate configuration of virtual machines for tasks like installing Java, Tomcat, and deploying applications. A past success story showed how CFEngine was implemented at DirecTV to manage over 3,500 servers, improving quality, enabling patching, and providing an automated CMDB. Key CFEngine concepts covered include desired state configuration, convergence, policy-based versus imperative configuration, and CFEngine's small footprint and ability to manage diverse platforms.

nebulaconfPedro Dias

This document discusses Pedro Dias's experience with OpenNebula. It describes how he used OpenNebula at his hosting company PTisp to replace their previous IaaS solution. OpenNebula met their requirements of being open, avoiding vendor lock-in, and having a low maintenance stack. The document outlines some customizations made to OpenNebula, such as using LVM instead of cLVM and developing tools like ONE Janitor to help with storage and VM sanitization. It also mentions contributions to the OpenNebula project and developing a Node.js addon and multi-tenant web panel called Cloudash.

MySQL X protocol - Talking to MySQL Directly over the WireSimon J Mudd

The document discusses the MySQL X Protocol, which introduces a new way for clients to communicate directly with MySQL servers over TCP/IP. It provides an overview of how the protocol works, including capabilities exchange, authentication, querying the server for both SQL and noSQL data, pipelining requests, and the need for a formal protocol specification. Building client drivers requires understanding the protocol by reading documentation, source code, and examples as documentation is still incomplete. Pipelining requests can improve performance over high-latency connections. A standard specification would help driver development and ensure compatibility as the protocol evolves.

NGINX: Basics & Best Practices - EMEA BroadcastNGINX, Inc.

This document provides an overview of installing and configuring the NGINX web server. It discusses installing NGINX from official repositories or from source on Linux systems like Ubuntu, Debian, CentOS and Red Hat. It also covers verifying the installation, basic configurations for web serving, reverse proxying, load balancing and caching. The document discusses modifications that can be made to the main nginx.conf file to improve performance and reliability. It also covers monitoring NGINX using status pages and logs, and summarizes key documentation resources.

Socket programming, and openrestyTavish Naruka

Nagios Conference 2014 - Eric Mislivec - Getting Started With Nagios CoreNagios

Improving Kafka at-least-once performance at UberYing Zheng

Tomcat from a cluster to the cloud on RP3Jean-Frederic Clere

NGINX Installation and TuningNGINX, Inc.

Netty trainingJackson dos Santos Olveira

Irc how to sept 2012Christie Koehler

Guest Agents: Support & ImplementationMirantis

Optimizing Linux ServersDavor Guttierrez

haproxy_Load_Balancer.pptxcrezzcrezz

haproxy_Load_Balancer.pdfcrezzcrezz

Intro to Multi-WAN - pfSense Hangout April 2014Netgate

Netty trainingMarcelo Serpa

WebCamp 2016: Python. Вячеслав Каковский: Real-time мессенджер на Python. Осо...WebCamp

Server fleet management using Camunda by Akhil Ahujacamunda services GmbH

WebCamp Ukraine 2016: Instant messenger with Python. Back-end developmentViach Kakovskyi

It gilde 20150209Martin Simons

nebulaconfPedro Dias

MySQL X protocol - Talking to MySQL Directly over the WireSimon J Mudd

NGINX: Basics & Best Practices - EMEA BroadcastNGINX, Inc.

Recently uploaded (20)

論文紹介："InfLoRA: Interference-Free Low-Rank Adaptation for Continual Learning" ...Toru Tamaki

Yan-Shuo Liang, Wu-Jun Li,"Adaptive Plasticity Improvement for Continual Learning" CVPR2023 https://openaccess.thecvf.com/content/CVPR2023/html/Liang_Adaptive_Plasticity_Improvement_for_Continual_Learning_CVPR_2023_paper.html Yan-Shuo Liang, Wu-Jun Li,"InfLoRA: Interference-Free Low-Rank Adaptation for Continual Learning" CVPR2024 https://openaccess.thecvf.com/content/CVPR2024/html/Liang_InfLoRA_Interference-Free_Low-Rank_Adaptation_for_Continual_Learning_CVPR_2024_paper.html

MULTI-STAKEHOLDER CONSULTATION PROGRAM On Implementation of DNF 2.0 and Way F...ICT Frame Magazine Pvt. Ltd.

Join us for the Multi-Stakeholder Consultation Program on the Implementation of Digital Nepal Framework (DNF) 2.0 and the Way Forward, a high-level workshop designed to foster inclusive dialogue, strategic collaboration, and actionable insights among key ICT stakeholders in Nepal. This national-level program brings together representatives from government bodies, private sector organizations, academia, civil society, and international development partners to discuss the roadmap, challenges, and opportunities in implementing DNF 2.0. With a focus on digital governance, data sovereignty, public-private partnerships, startup ecosystem development, and inclusive digital transformation, the workshop aims to build a shared vision for Nepal’s digital future. The event will feature expert presentations, panel discussions, and policy recommendations, setting the stage for unified action and sustained momentum in Nepal’s digital journey.

Refactoring meta-rauc-community: Cleaner Code, Better Maintenance, More MachinesLeon Anavi

RAUC is a widely used open-source solution for robust and secure software updates on embedded Linux devices. In 2020, the Yocto/OpenEmbedded layer meta-rauc-community was created to provide demo RAUC integrations for a variety of popular development boards. The goal was to support the embedded Linux community by offering practical, working examples of RAUC in action - helping developers get started quickly. Since its inception, the layer has tracked and supported the Long Term Support (LTS) releases of the Yocto Project, including Dunfell (April 2020), Kirkstone (April 2022), and Scarthgap (April 2024), alongside active development in the main branch. Structured as a collection of layers tailored to different machine configurations, meta-rauc-community has delivered demo integrations for a wide variety of boards, utilizing their respective BSP layers. These include widely used platforms such as the Raspberry Pi, NXP i.MX6 and i.MX8, Rockchip, Allwinner, STM32MP, and NVIDIA Tegra. Five years into the project, a significant refactoring effort was launched to address increasing duplication and divergence in the layer’s codebase. The new direction involves consolidating shared logic into a dedicated meta-rauc-community base layer, which will serve as the foundation for all supported machines. This centralization reduces redundancy, simplifies maintenance, and ensures a more sustainable development process. The ongoing work, currently taking place in the main branch, targets readiness for the upcoming Yocto Project release codenamed Wrynose (expected in 2026). Beyond reducing technical debt, the refactoring will introduce unified testing procedures and streamlined porting guidelines. These enhancements are designed to improve overall consistency across supported hardware platforms and make it easier for contributors and users to extend RAUC support to new machines. The community's input is highly valued: What best practices should be promoted? What features or improvements would you like to see in meta-rauc-community in the long term? Let’s start a discussion on how this layer can become even more helpful, maintainable, and future-ready - together.

Slack like a pro: strategies for 10x engineering teamsNacho Cougil

You know Slack, right? It's that tool that some of us have known for the amount of "noise" it generates per second (and that many of us mute as soon as we install it 😅). But, do you really know it? Do you know how to use it to get the most out of it? Are you sure 🤔? Are you tired of the amount of messages you have to reply to? Are you worried about the hundred conversations you have open? Or are you unaware of changes in projects relevant to your team? Would you like to automate tasks but don't know how to do so? In this session, I'll try to share how using Slack can help you to be more productive, not only for you but for your colleagues and how that can help you to be much more efficient... and live more relaxed 😉. If you thought that our work was based (only) on writing code, ... I'm sorry to tell you, but the truth is that it's not 😅. What's more, in the fast-paced world we live in, where so many things change at an accelerated speed, communication is key, and if you use Slack, you should learn to make the most of it. --- Presentation shared at JCON Europe '25 Feedback form: http://tiny.cc/slack-like-a-pro-feedback

Bridging AI and Human Expertise: Designing for Trust and Adoption in Expert S...UXPA Boston

AI and Machine Learning are transforming expert systems, augmenting human decision-making in fields ranging from finance and healthcare to manufacturing and supply chain. But for AI to be truly effective, experts must trust and adopt these systems. This talk explores how UX practitioners can bridge the gap between AI’s computational power and human expertise. We'll discuss key challenges, including designing for trust, working with the limits of explainability, and ensuring adoption through user-centered strategies. Attendees will gain practical insights into how to craft AI-driven experiences that experts rely on with confidence, ensuring these systems enhance rather than hinder decision-making.

How Top Companies Benefit from OutsourcingNascenture

ICDCC 2025: Securing Agentic AI - Eryk Budi Pratama.pdfEryk Budi Pratama

Title: Securing Agentic AI: Infrastructure Strategies for the Brains Behind the Bots As AI systems evolve toward greater autonomy, the emergence of Agentic AI—AI that can reason, plan, recall, and interact with external tools—presents both transformative potential and critical security risks. This presentation explores: > What Agentic AI is and how it operates (perceives → reasons → acts) > Real-world enterprise use cases: enterprise co-pilots, DevOps automation, multi-agent orchestration, and decision-making support > Key risks based on the OWASP Agentic AI Threat Model, including memory poisoning, tool misuse, privilege compromise, cascading hallucinations, and rogue agents > Infrastructure challenges unique to Agentic AI: unbounded tool access, AI identity spoofing, untraceable decision logic, persistent memory surfaces, and human-in-the-loop fatigue > Reference architectures for single-agent and multi-agent systems > Mitigation strategies aligned with the OWASP Agentic AI Security Playbooks, covering: reasoning traceability, memory protection, secure tool execution, RBAC, HITL protection, and multi-agent trust enforcement > Future-proofing infrastructure with observability, agent isolation, Zero Trust, and agent-specific threat modeling in the SDLC > Call to action: enforce memory hygiene, integrate red teaming, apply Zero Trust principles, and proactively govern AI behavior Presented at the Indonesia Cloud & Datacenter Convention (IDCDC) 2025, this session offers actionable guidance for building secure and trustworthy infrastructure to support the next generation of autonomous, tool-using AI agents.

SQL Database Design For Developers at PhpTek 2025.pptxScott Keck-Warren

Who's choice? Making decisions with and about Artificial Intelligence, Keele ...Alan Dix

Invited talk at Designing for People: AI and the Benefits of Human-Centred Digital Products, Digital & AI Revolution week, Keele University, 14th May 2025 https://www.alandix.com/academic/talks/Keele-2025/ In many areas it already seems that AI is in charge, from choosing drivers for a ride, to choosing targets for rocket attacks. None are without a level of human oversight: in some cases the overarching rules are set by humans, in others humans rubber-stamp opaque outcomes of unfathomable systems. Can we design ways for humans and AI to work together that retain essential human autonomy and responsibility, whilst also allowing AI to work to its full potential? These choices are critical as AI is increasingly part of life or death decisions, from diagnosis in healthcare ro autonomous vehicles on highways, furthermore issues of bias and privacy challenge the fairness of society overall and personal sovereignty of our own data. This talk will build on long-term work on AI & HCI and more recent work funded by EU TANGO and SoBigData++ projects. It will discuss some of the ways HCI can help create situations where humans can work effectively alongside AI, and also where AI might help designers create more effective HCI.

machines-for-woodworking-shops-en-compressed.pdfAmirStern2

Building a research repository that works by Clare CadyUXPA Boston

Are you constantly answering, "Hey, have we done any research on...?" It’s a familiar question for UX professionals and researchers, and the answer often involves sifting through years of archives or risking lost insights due to team turnover. Join a deep dive into building a UX research repository that not only stores your data but makes it accessible, actionable, and sustainable. Learn how our UX research team tackled years of disparate data by leveraging an AI tool to create a centralized, searchable repository that serves the entire organization. This session will guide you through tool selection, safeguarding intellectual property, training AI models to deliver accurate and actionable results, and empowering your team to confidently use this tool. Are you ready to transform your UX research process? Attend this session and take the first step toward developing a UX repository that empowers your team and strengthens design outcomes across your organization.

Right to liberty and security of a person.pdfdanielbraico197

TrustArc Webinar: Cross-Border Data Transfers in 2025TrustArc

In 2025, cross-border data transfers are becoming harder to manage—not because there are no rules, the regulatory environment has become increasingly complex. Legal obligations vary by jurisdiction, and risk factors include national security, AI, and vendor exposure. Some of the examples of the recent developments that are reshaping how organizations must approach transfer governance: - The U.S. DOJ’s new rule restricts the outbound transfer of sensitive personal data to foreign adversaries countries of concern, introducing national security-based exposure that privacy teams must now assess. - The EDPB confirmed that GDPR applies to AI model training — meaning any model trained on EU personal data, regardless of location, must meet lawful processing and cross-border transfer standards. - Recent enforcement — such as a €290 million GDPR fine against Uber for unlawful transfers and a €30.5 million fine against Clearview AI for scraping biometric data signals growing regulatory intolerance for cross-border data misuse, especially when transparency and lawful basis are lacking. - Gartner forecasts that by 2027, over 40% of AI-related privacy violations will result from unintended cross-border data exposure via GenAI tools. Together, these developments reflect a new era of privacy risk: not just legal exposure—but operational fragility. Privacy programs must/can now defend transfers at the system, vendor, and use-case level—with documentation, certification, and proactive governance. The session blends policy/regulatory events and risk framing with practical enablement, using these developments to explain how TrustArc’s Data Mapping & Risk Manager, Assessment Manager and Assurance Services help organizations build defensible, scalable cross-border data transfer programs. This webinar is eligible for 1 CPE credit.

Best 10 Free AI Character Chat PlatformsSoulmaite

This guide highlights the best 10 free AI character chat platforms available today, covering a range of options from emotionally intelligent companions to adult-focused AI chats. Each platform brings something unique—whether it's romantic interactions, fantasy roleplay, or explicit content—tailored to different user preferences. From Soulmaite’s personalized 18+ characters and Sugarlab AI’s NSFW tools, to creative storytelling in AI Dungeon and visual chats in Dreamily, this list offers a diverse mix of experiences. Whether you're seeking connection, entertainment, or adult fantasy, these AI platforms provide a private and customizable way to engage with virtual characters for free.

In-App Guidance_ Save Enterprises Millions in Training & IT Costs.pptxaptyai

Crazy Incentives and How They Kill Security. How Do You Turn the Wheel?Christian Folini

Everybody is driven by incentives. Good incentives persuade us to do the right thing and patch our servers. Bad incentives make us eat unhealthy food and follow stupid security practices. There is a huge resource problem in IT, especially in the IT security industry. Therefore, you would expect people to pay attention to the existing incentives and the ones they create with their budget allocation, their awareness training, their security reports, etc. But reality paints a different picture: Bad incentives all around! We see insane security practices eating valuable time and online training annoying corporate users. But it's even worse. I've come across incentives that lure companies into creating bad products, and I've seen companies create products that incentivize their customers to waste their time. It takes people like you and me to say "NO" and stand up for real security!

OpenAI Just Announced Codex: A cloud engineering agent that excels in handlin...SOFTTECHHUB

Longitudinal Benchmark: A Real-World UX Case Study in Onboarding by Linda Bor...UXPA Boston

This is a case study of a three-part longitudinal research study with 100 prospects to understand their onboarding experiences. In part one, we performed a heuristic evaluation of the websites and the getting started experiences of our product and six competitors. In part two, prospective customers evaluated the website of our product and one other competitor (best performer from part one), chose one product they were most interested in trying, and explained why. After selecting the one they were most interested in, we asked them to create an account to understand their first impressions. In part three, we invited the same prospective customers back a week later for a follow-up session with their chosen product. They performed a series of tasks while sharing feedback throughout the process. We collected both quantitative and qualitative data to make actionable recommendations for marketing, product development, and engineering, highlighting the value of user-centered research in driving product and service improvements.

Mastering Testing in the Modern F&B Landscapemarketing943205

Dive into our presentation to explore the unique software testing challenges the Food and Beverage sector faces today. We’ll walk you through essential best practices for quality assurance and show you exactly how Qyrus, with our intelligent testing platform and innovative AlVerse, provides tailored solutions to help your F&B business master these challenges. Discover how you can ensure quality and innovate with confidence in this exciting digital era.

Integrating FME with Python: Tips, Demos, and Best Practices for Powerful Aut...Safe Software

FME is renowned for its no-code data integration capabilities, but that doesn’t mean you have to abandon coding entirely. In fact, Python’s versatility can enhance FME workflows, enabling users to migrate data, automate tasks, and build custom solutions. Whether you’re looking to incorporate Python scripts or use ArcPy within FME, this webinar is for you! Join us as we dive into the integration of Python with FME, exploring practical tips, demos, and the flexibility of Python across different FME versions. You’ll also learn how to manage SSL integration and tackle Python package installations using the command line. During the hour, we’ll discuss: -Top reasons for using Python within FME workflows -Demos on integrating Python scripts and handling attributes -Best practices for startup and shutdown scripts -Using FME’s AI Assist to optimize your workflows -Setting up FME Objects for external IDEs Because when you need to code, the focus should be on results—not compatibility issues. Join us to master the art of combining Python and FME for powerful automation and data migration.

論文紹介："InfLoRA: Interference-Free Low-Rank Adaptation for Continual Learning" ...Toru Tamaki

MULTI-STAKEHOLDER CONSULTATION PROGRAM On Implementation of DNF 2.0 and Way F...ICT Frame Magazine Pvt. Ltd.

Refactoring meta-rauc-community: Cleaner Code, Better Maintenance, More MachinesLeon Anavi

Slack like a pro: strategies for 10x engineering teamsNacho Cougil

Bridging AI and Human Expertise: Designing for Trust and Adoption in Expert S...UXPA Boston

How Top Companies Benefit from OutsourcingNascenture

ICDCC 2025: Securing Agentic AI - Eryk Budi Pratama.pdfEryk Budi Pratama

SQL Database Design For Developers at PhpTek 2025.pptxScott Keck-Warren

Who's choice? Making decisions with and about Artificial Intelligence, Keele ...Alan Dix

machines-for-woodworking-shops-en-compressed.pdfAmirStern2

Building a research repository that works by Clare CadyUXPA Boston

Right to liberty and security of a person.pdfdanielbraico197

TrustArc Webinar: Cross-Border Data Transfers in 2025TrustArc

Best 10 Free AI Character Chat PlatformsSoulmaite

In-App Guidance_ Save Enterprises Millions in Training & IT Costs.pptxaptyai

Crazy Incentives and How They Kill Security. How Do You Turn the Wheel?Christian Folini

OpenAI Just Announced Codex: A cloud engineering agent that excels in handlin...SOFTTECHHUB

Longitudinal Benchmark: A Real-World UX Case Study in Onboarding by Linda Bor...UXPA Boston

Mastering Testing in the Modern F&B Landscapemarketing943205

Integrating FME with Python: Tips, Demos, and Best Practices for Powerful Aut...Safe Software

PHP at Density and Scale

1. PHP at Density and Scale How Pantheon sees the future of computing.

2. About Me ● Four Kitchens ● Drupal.org ● Pressflow ● Pantheon ● systemd

3. Topics ● Performance ○ Socket activation ○ Automount/autofs ○ cgroups ○ “Customer Experience Monitor” ○ Migration ● Security ○ Users ○ Namespaces ○ Defense-in-depth ○ Non-disruptive fixes

4. Traditional server sockets: overview ... nginx TCP 80 Client nginx TCP 81 If you want a service available, the daemon has to be running.

5. Socket activation: overview systemd TCP 80 Client TCP 81 nginxfd=3 Only a socket in systemd has to run for service availability.

6. Socket activation: details ● systemd squats on all listeners ○ Looks for incoming traffic with EPOLL ○ Starts the services/containers on-demand ○ Passes socket to daemon as fd=3 ● Not a proxy (same performance) ● No client awareness

7. Socket activation: Pantheon’s use ● nginx and PHP-FPM ● MariaDB soon ○ Using an alternative now ● Allows 90%+ containers to be idle ● Makes bootup sensible ● Reconfiguration pattern is stop, not restart

8. Socket Activation Demo

9. Automount/autofs ● Like socket activation for file system mounts ○ Kernel squats on mount path and looks for traffic ○ Brings up file mount lazily ● Used for FuseDAV (Valhalla client)

10. Automount Demo

11. cgroups ● Many options ○ Pantheon uses CPUShares and BlockIOWeight ● Keeps things fair under contention ○ Kind of like adding purple ropes when people are queueing

12. Contention with cgroups Demo

13. Customer Experience Monitor ● Runs a representative Drupal site on every container host ● Reports scores to the API and monitoring ● Influences migration and container placement

14. Migration ● At density, rebalancing is important ● Keep state lightweight ○ No OS ○ No runtime ● Mutiny: migration as replication + promotion

15. Isolation for security ● Users ● Namespaces

16. Defense in depth ● Application ○ Drupal ● Runtime ○ nginx, PHP-FPM, FuseDAV ● Container: “binding” certificate ○ Linux user, namespaces, etc. ● Container host: “endpoint” certificate ○ Only trusted for the containers assigned ● Platform: root certificate

17. Non-disruptive fixes ● Kernel upgrades via migration ● Rolling daemon and library upgrades ○ Heartbleed

18. Heartbleed Fix Demo

PHP at Density and Scale

Recommended

More Related Content

What's hot (20)

Viewers also liked (10)

Similar to PHP at Density and Scale (20)

Recently uploaded (20)

PHP at Density and Scale