Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Pingora, the proxy that connects Cloudflare to the Internet

blog.cloudflare.com

Post reply on HN
Print view View original

101–110 of 127 posts

Re: Pingora, the proxy that connects Cloudflare to the Internet

#101

Post by 0x457 »

otikik wrote: post #95
rkagerer wrote: post #42

Earlier quoted context omitted.

Which aspect(s) of Rust do you think are most responsible for this? (e.g. borrow checker, memory safety, culture that attracts devs who care about reliability, etc)

I think ultimately the big thing Rust brings to the table is that a lot of Rust's features is geared towards detecting problems as early as possible. This means you get complexity, especially on the "initial phases". * The initial learning curve is steeper than usual . You have x types of string instead of one or two, you have lifetimes, etc, etc. Fortunately you pay it once and then can use it many times (maybe with…

Agree with you on most except for one point:

> You have x types of string instead of one or two

Funny how you said X, while there are really only 3 types of strings in standard library. You generally only encounter 2 of them: String and OsString. OsString, while annoying, but it's one of the things that makes rust safe. You only ever deal with 3rd type, CString, when you work with FFI, at which point you better already know how strings work on C.

Re: Pingora, the proxy that connects Cloudflare to the Internet

#102

Post by 0x457 »

datalopers wrote: post #33
xfalcox wrote: post #5

I share lots of feelings towards NGINX that Cloudflare mention on this blog post. New features like 103 Early Hints and HTTP/3 exist in HAProxy and Caddy but there is nothing coming in NGINX.

nginx was good for a decade or two. they were acquired and doomed to irrelevancy since.

Nginx is an absolute beast when it comes to accepting HTTP/1.1 from clients and talking HTTP/1.0 (or HTTP/1.1) to a fixed list of backends or serving files from disk.

Everything else is...hard. Writing plugins - arcane knowledge with next no none documentation. 3rd party plugins, multiple times "acquired" (read: paid the author to work on a new plugin) an open-source plugin and made a much better version available in this plus offering.

gRPC support added only in 2018, http2 support was late, proper web sockets support was late.

Many features that were available "for free" with OpenResty were only on the paid version - good luck writing your own plugin.

They were doomed before F5 probably around round time when they raised series B1 in 2014. All this money and it still had nothing "new" to show. For every Plus plugin, there was most likely a better solution available, and often enough that solution was free or cheaper.

Almost nothing has changed since F5 aquired them.

Re: Pingora, the proxy that connects Cloudflare to the Internet

#103

Post by 0x457 »

tothrowaway wrote: post #28

Does anyone know why nginx used separate processes for workers, instead of threads? This post makes it sound like threads are the way to go, but presumably nginx had a reason for using processes back in the day.

It was easier to develop, easy to do zero-downtime graceful restarts and reloads, tooling available today wasn't available back then. SMP in FreeBSD 5.x was uhm...very bad...

Re: Pingora, the proxy that connects Cloudflare to the Internet

#104

Post by 0x457 »

TheFlyingFish wrote: post #46
rowin wrote: post #41

Was Go considered as the language to write Pingora in? If so, why was Rust chosen?

Not from Cloudflare, but at a guess: * They already have some pretty deep Rust experience on staff * They were already dissatisfied with the performance penalty from Lua's GC, so Go's GC was presumably unattractive as well * Rust is worth more internet points than Go (just kidding, mostly)

Well, rust's async ecosystem is top-notch as long as you're writing a network load balancer...

Re: Pingora, the proxy that connects Cloudflare to the Internet

#105

Post by 0x457 »

boris wrote: post #15

I wonder how this is deployed to presumably a large number of hosts? Do you build a distribution package out of your Rust build and ship that? If so, what about the Rust standard library? Though I believe some distributions do provide a package for the Rust standard library, but that means one also has to use the packaged rustc/cargo, which tends to lag behind quite a bit.

Rust doesn't have stable ABI, so distributions don't provide "standard library", they provide the toolchain you use to build your rust packages. Emphasis on packages because that's the use-case for toolchain provided by distro and not local development.

In the end, you end up with a binary that is statically linked, except for `glibc` (unless you use libc like musl) and whatever C library you choose to dynamically link against.

Since this is an in-house project, they can build their packages with whatever toolchain they choose and distribute packages for deployment. So whatever toolchain provided by distro is irrelevant unless this packages is part of the distro's official package repository (which it isn't in this case).

Re: Pingora, the proxy that connects Cloudflare to the Internet

#106

Post by 0x457 »

latchkey wrote: post #67
jgrahamc wrote: post #20

Earlier quoted context omitted.

It will be. There will be a follow up blog post about the open sourcing with all the gory details of how it was built and how it works.

I think you should remove the part about closed door development as a negative for nginx given the way that this has been developed.

Why? It's closed door development in nginx from their perspective. This doesn't apply for their in-house project. They not telling you why you would want to switch off Nginx, they are telling you why they've switched.

Re: Pingora, the proxy that connects Cloudflare to the Internet

#107

Post by zamadatix »

trillic wrote: post #34
BonoboIO wrote: post #32

Earlier quoted context omitted.

Wow ... 100 Gbit/s. Where do you work? That’s some serious traffic.

100 Gbit/s is only like 3000 concurrent viewers at 5000 KiB/s.

40 Mbps seems roughly 5x-10x the bitrate I'd expect for this kind of thing.

Re: Pingora, the proxy that connects Cloudflare to the Internet

#108

Post by pjmlp »

> Our Rust code runs more efficiently compared to our old Lua code.

What a surprise, replacing an interpred dynamic language with a AOT compiled static language leads to performance improvements.

I guess the learnings using Tcl as configuration language for Apache based proxies 20 years ago was lost in newer generations.

Re: Pingora, the proxy that connects Cloudflare to the Internet

#109

Post by ellieh »

nicoburns wrote: post #6

> When crashes do occur an engineer needs to spend time to diagnose how it happened and what caused it. Since Pingora's inception we’ve served a few hundred trillion requests and have yet to crash due to our service code. > In fact, Pingora crashes are so rare we usually find unrelated issues when we do encounter one. Recently we discovered a kernel bug soon after our service started crashing. We've also discovered h…

Similar experience over here too, I've been running a Rust server in production for >1yr now and had absolutely no crashes. Resource usage has been nice and constant too. It's fantastic :)

Re: Pingora, the proxy that connects Cloudflare to the Internet

#110

Post by nicoburns »

0x457 wrote: post #101
otikik wrote: post #95

Earlier quoted context omitted.

I think ultimately the big thing Rust brings to the table is that a lot of Rust's features is geared towards detecting problems as early as possible. This means you get complexity, especially on the "initial phases". * The initial learning curve is steeper than usual . You have x types of string instead of one or two, you have lifetimes, etc, etc. Fortunately you pay it once and then can use it many times (maybe with…

Agree with you on most except for one point: > You have x types of string instead of one or two Funny how you said X, while there are really only 3 types of strings in standard library. You generally only encounter 2 of them: String and OsString. OsString, while annoying, but it's one of the things that makes rust safe. You only ever deal with 3rd type, CString, when you work with FFI, at which point you better alrea…

There is also PathBuf, which would use a string in most languages. And sometimes one may need to work with Vec or Vec. And then slice/view variants of all the above.
Post reply on HN