Case Study: Npm uses Rust for its CPU-bound bottlenecks [pdf]

Post by victor106 » Sun, Mar 03, 2019, 7:05 PM UTC

oweiler wrote: post #42

javagram wrote: post #5

Title could be improved, as I was wondering if the command line tool npm had itself been rewritten. It’s actually one of npm’s web services that was rewritten. FTA: “Java was excluded from consideration because of the requirement of deploying the JVM and associated libraries along with any program to their production servers. This was an amount of operational complexity and resource overhead that was as undesirable a…

Also with GraalVM you may get away with building a native image which doesn't require a JVM at all.

Post by gkop » Sun, Mar 03, 2019, 7:10 PM UTC

GordonS wrote: post #112

atoav wrote: post #50

Earlier quoted context omitted.

Rust's package managment (cargo) is the best thing I have ever seen of it's kind. The very basic thing you can do is: cargo new funkyproject Which creates a new barebones rust project called "funkyproject". Every dependency specified in it's Cargo.toml will be automatically downloaded at build (if there is a new version). When a build is sucessful the versions of said dependency will be saved into a Cargo.lock file.…

That sounds pretty similar to NPM, as well as NuGet and Paket for .NET. TBH, it's the 'obvious' way for a package manager to work, so I'd be a little surprised if they didn't all work more or less the same?

Post by koolba » Sun, Mar 03, 2019, 7:16 PM UTC

shaklee3 wrote: post #127

rmrfrmrf wrote: post #68

Earlier quoted context omitted.

I'm not a fan of relying on distro package managers for installation of runtime dependencies on servers. Too many opportunites for variables to creep in if the version isn't locked, and then having to make sure all the package manager dependencies and config themselves. Even if you automate you're still at the mercy of the repo to have the version you need etc. and often times you need to customize the install for a…

What's the alternative? Not installing the dependencies so the app doesn't work?

Post by victor106 » Sun, Mar 03, 2019, 7:22 PM UTC

ricardobeat wrote: post #144

BlackFly wrote: post #53

> Java was excluded from consideration because of the requirement of deploying the JVM and associated libraries along with any program to their production servers. This was an amount of operational complexity and resource overhead that was as undesirable as the unsafety of C or C++. Just so everyone here is aware, this is by now an outdated complaint against Java. https://vertx.io/blog/eclipse-vert-x-goes-native/ I'm…

Are there any companies using these native images in production?

Post by Dylan16807 » Sun, Mar 03, 2019, 7:29 PM UTC

Filligree wrote: post #132

tyingq wrote: post #99

Earlier quoted context omitted.

I'm not clear on why this is particularly CPU heavy, though: "the authorization service that determines whether a user is allowed to, say, publish a particular package"

Lots of users. Anything will be CPU-heavy if you give it enough work. Except the things that end up being memory-bound instead, but the NPM database isn't large enough for that.