Live data from Hacker News

Pingora, the proxy that connects Cloudflare to the Internet

blog.cloudflare.com

81–90 of 127 posts

Re: Pingora, the proxy that connects Cloudflare to the Internet

#81

Does anyone know why nginx used separate processes for workers, instead of threads? This post makes it sound like threads are the way to go, but presumably nginx had a reason for using processes back in the day.

Haproxy had a similar architecture for a long time, but recently switched to a worker threads model.

Re: Pingora, the proxy that connects Cloudflare to the Internet

#82

What are HTTP status codes greater than 599 used for in practice? It'd be interesting to see another Cloudflare blog post that just goes into detail on the weird protocol behaviour they've had to work around over the years. I imagine they have more insight into this than pretty much any other organisation on the planet.

If you are in the HTTP proxying business, you might not even know. It's just customer workflows using those status codes. And you can pick either to support them, or to lose the ability to handle traffic for those customers.

Re: Pingora, the proxy that connects Cloudflare to the Internet

#84

Besides comparing this to Nginx plus Lua (OpenResty), has Cloudflare compared it to Haproxy plus Lua or any other similar proxies. The main issue for me with Rust is that it takes significantly more resources (time, space, memory, CPU) to build projects from source. Building Haproxy is comparatively quick and easy. The haproxy plus lua static binary (musl, no pcre) I use is already growing rather large. I will bet th…

Curious: when building software, especially mission critical software, why are things like time, space, memory, and CPU at build time a concern? The concerns that usually surface for me are reliability, and performance (time, space, memory, CUP) of the resulting binary at run time. What you mention is kinda the core tradeoff. With Rust, you pay for high reliability and performance by spending cycles at compile time to ensure as much. Cloudflare certainly isn't looking to ship a new sexy live-reloaded and written in 30 minutes nodejs app to production 12 times a day. Plus I'm sure CF has some beastly build infrastructure.

Re: Pingora, the proxy that connects Cloudflare to the Internet

#85

> When crashes do occur an engineer needs to spend time to diagnose how it happened and what caused it. Since Pingora's inception we’ve served a few hundred trillion requests and have yet to crash due to our service code. > In fact, Pingora crashes are so rare we usually find unrelated issues when we do encounter one. Recently we discovered a kernel bug soon after our service started crashing. We've also discovered h…

Came here to post this quote too.

This is my experience (albeit at smaller scale) exactly. If this wasn't the case, Rust would be snake oil and I'd be the first to admit it. Until my most recent endeavor with a rust backend, among other things, I simply didn't know it was possible to not have to debug crashes. Seriously. The pleasure of maintaining rust software in production is so wildly different from anything I've ever experienced in the past that I gladly submit to the compiler over and over and over again. It's worth the investment 100 fold.

Re: Pingora, the proxy that connects Cloudflare to the Internet

#86

Besides comparing this to Nginx plus Lua (OpenResty), has Cloudflare compared it to Haproxy plus Lua or any other similar proxies. The main issue for me with Rust is that it takes significantly more resources (time, space, memory, CPU) to build projects from source. Building Haproxy is comparatively quick and easy. The haproxy plus lua static binary (musl, no pcre) I use is already growing rather large. I will bet th…

Why are these a concern?

Build time can be annoying, absolutely, but that's the tradeoff of Rust -- compiler does a lot of work so the program can be beastly fast and very reliable at run time.

I don't like big binaries either, mind you, but I view this as a very minor concern for a mission-critical piece of software.

Choosing speed and correctness at run time is what I would have done as well.

Re: Pingora, the proxy that connects Cloudflare to the Internet

#87

Besides comparing this to Nginx plus Lua (OpenResty), has Cloudflare compared it to Haproxy plus Lua or any other similar proxies. The main issue for me with Rust is that it takes significantly more resources (time, space, memory, CPU) to build projects from source. Building Haproxy is comparatively quick and easy. The haproxy plus lua static binary (musl, no pcre) I use is already growing rather large. I will bet th…

[deleted]

Re: Pingora, the proxy that connects Cloudflare to the Internet

#88
post #75

They don't say much on why not Envoy. It would be interesting to hear if there were concerns with it.

To me it looked like they didn't have anything technical against Envoy, they just didn't want to be dependent upon someone else for what is a core part of their product anymore. Which is entirely reasonable and a good idea.

That’s right. Long ago we used an open source DNS server for our authoritative service and at some we knew we had to own our our destiny. Same here.

Re: Pingora, the proxy that connects Cloudflare to the Internet

#89

Earlier quoted context omitted.

A german company building an app for watching linear TV. Netflix is actually serving 400Gbit/s per node and already have 800Gbit/s ready. I think we can scale our setup up to 200 Gbit/s but we are too small. Total traffic is ~2 Tbit/s. Most challenging is the missing support of QUIC/http3 and KTLS in Golang. Also 100G NIC supply chain is difficult. We use NVIDIA Connect-X 6, but it's impossible to get a version with…

Es liegt mir auf der Zunge welche Firma das ist. I think it starts with a Wa ... you don’t have to say. I kind of remember to have been stumbled on a Twitter engineering ipv6 tweet. Maybe I m wrong. For me it’s impressive to get so much data through a computer. But I have one question, what does count as a node, is a node like 1 machine with dual sockets, a lot of ram and a lot of nics or is it like multiple machines…

A single node is single socket AMD EPCY node with 32 cores, 64 or 128GB RAM, 1x NIC with 2x100 GB/s. Ja, es ist waipu.tv.

Re: Pingora, the proxy that connects Cloudflare to the Internet

#90
post #74

Earlier quoted context omitted.

A german company building an app for watching linear TV. Netflix is actually serving 400Gbit/s per node and already have 800Gbit/s ready. I think we can scale our setup up to 200 Gbit/s but we are too small. Total traffic is ~2 Tbit/s. Most challenging is the missing support of QUIC/http3 and KTLS in Golang. Also 100G NIC supply chain is difficult. We use NVIDIA Connect-X 6, but it's impossible to get a version with…

Interesting, do you do a lot of processing in Golang or basically you just use it as a wrapper around sendfile[1] ? 1. https://man7.org/linux/man-pages/man2/sendfile.2.html

We can't use sendfile since all the traffic is HTTPS. Sendfile can only be used if we can use KTLS. Internally we have some kind of cache hierarchy for video objects, these files are transferred out via Sendfile, but the performance gain here is negligible.
Post reply on HN