4 ms·
Show HN: I built a memory-safe web server in Rust
The web server that I am building is currently in beta, so any feedback is welcome.
- panny 2y ago[flagged]
- deleted 2y ago[deleted]
- 1oooqooq 2y agothanks for sharing. what's the commercial plans? i will add to the pile of cgi hosts in our CI for weird and borderline hostile php projects and report back.
- dorianniemiec 2y agoThank you! Right now, I don't have any commercial plans for my web server. My web server is free to use for everyone, and it's open source.
- qweqwe14 2y agoHave you heard of axum[1] or actix-web[2]? What does this do that existing Rust web servers don't? I think the "web server" ecosystem in Rust is pretty mature by now, so you should probably state in what way your project is novel on the website. Edit: OK, I realized that this is supposed to be an nginx/caddy replacement, so a complete, configurable web server/proxy. Maybe check out https://github.com/memorysafety/river https://github.com/memorysafety/river or https://github.com/sozu-proxy/sozu https://github.com/sozu-proxy/sozu [1] https://docs.rs/axum https://docs.rs/axum [2] https://docs.rs/actix-web https://docs.rs/actix-web
- dorianniemiec 2y agoYes, I know that both Axum and Actix Web exist. However, these are web application frameworks designed for building web applications in Rust. On the other hand, my project is a standalone web server, similar to Apache httpd, NGINX, or Caddy. While there are standalone web servers in Rust, such as Static Web Server and binserve, they primarily focus on serving static files rather than providing general-purpose web hosting capabilities. My goal is to create a more versatile web server that can handle a wider range of web hosting applications.
- qweqwe14 2y agoWhat about Cloudflare's pengora? Edit: or https://github.com/memorysafety/river https://github.com/memorysafety/river Edit 2: or https://github.com/sozu-proxy/sozu https://github.com/sozu-proxy/sozu
- Maledictus 2y agohttps://github.com/cloudflare/pingora https://github.com/cloudflare/pingora seems to be focused on providing a library/framework
- dorianniemiec 2y agoPingora is not a standalone web server (like NGINX or Apache httpd), it's a Rust-based framework developed by Cloudflare for building network services, particularly HTTP proxies. River (built on Pingora) is designed to be a reverse proxy. My web server on the other hand is designed to be a general-purpose web server (it also supports reverse proxying).
- throwbacktictac 2y agoIt sounds like this is a general purpose web server rather than a web framework like axum and actix-web. It's in the category of nginx, apache or caddy.
- dorianniemiec 2y agoI agree with you.
- deleted 2y ago[deleted]
- IshKebab 2y agoThis was my question too so I think it's worth clarifying that on the home page.
- dorianniemiec 2y agoI have just added a "What are the differences between Ferron and other web servers written in Rust?" question to Frequently Asked Questions.
- sejje 2y agoApparently you need to add "what is a webserver" for these new guys.
- dorianniemiec 2y agoIt's already in the FAQ section.
- satvikpendem 2y agoYou should also add more context on how it's different from Nginx and Caddy as well to that answer, your one above works well [0]. [0] https://news.ycombinator.com/item?id=43228231#43228376 https://news.ycombinator.com/item?id=43228231#43228376
- deleted 2y ago[deleted]
- Maledictus 2y agoI'd mention fearless concurrency on the website/blog post, as that distinguishes your webserver from, say, caddy.
- IshKebab 2y agoI wouldn't. Blazing fast, fearless concurrency, etc. are all super cringe at this point. Just say it's fast, secure and reliable or something like that.
- karunamurti 2y agoNo it's not.
- bangaladore 2y agoI tend to agree. It makes me think that a project is more interested in optics / following trends and is likely overstating things. Instead of "Blazing Fast", just show a chart showing you are better per core than XYZ. Instead of "fearless concurrency", show that you are better at utilizing system resources than XYZ.
- dorianniemiec 2y agoThank you for the feedback! I think this is an advantage of Rust that prevents common pitfalls related to concurrent programming, making web servers written in Rust safer.
- jbverschoor 2y ago1) The graph still shows karpacz, which is super confusing. 2) Where's nginx in this graph? It feels very disingenuous. Esp when serving a default nginx page
- deleted 2y ago[deleted]
- dorianniemiec 2y agoI have updated the web server performance benchmark chart (there's now Ferron 1.0.0-beta1 instead of Project Karpacz 0.3.0), you can check it out.
- reacharavindh 2y agoAs welcome as the efficiency and performance features are, the convenience of lets encrypt integration in Caddy wins the decision almost all the time. No more certbot cron jobs or worries about having the certs in the right place or permissions etc. for this to be equivalent to Caddy, that is the most important convenience feature.
- deleted 2y ago[deleted]
- dorianniemiec 2y agoOf course, my web server supports automatic TLS (through TLS-ALPN-01 challenge), just like Caddy.
- reacharavindh 2y agoI apologise for my low quality comment. I only read the website and did not actually try the web server. It wasn’t highlighted on the homepage(like Caddy does) and I made a tardy assumption.
- do_not_redeem 2y agoI see that it's written in Rust, besides that, what's your ambition for why an end user would choose this project over one of the established players like Caddy/Traefik/nginx?
- deleted 2y ago[deleted]
- adastra22 2y agoThis web server is probably awesome. However "memory-safe" isn't distinguishing within the Rust ecosystem. There's... a lot... of Rust web servers out there, all of which are presumably memory-safe, because Rust: https://github.com/flosse/rust-web-framework-comparison https://github.com/flosse/rust-web-framework-comparison How does Ferron distinguish itself from these? I didn't get that from skimming the landing page.
- dorianniemiec 2y agoThank you! Many other web server written in Rust are memory-safe as well, because of Rust's borrow checker. I designed Ferron to be a general-purpose, standalone web server, just like NGINX or Caddy. It can even run PHP web applications (through FastCGI).
- hnlmorg 2y agoYou’re right, but the state of play is even better than you suggest because there’s a lot of memory safe web servers outside of Rust too. Eg Go. And that’s not even counting all the webservers included as part of their backend frameworks in Python, node.js, Java, etc. web servers written in unsafe languages are really the minority but those that do exist are largely so heavily battle tested that a rewrite would likely introduce new sources of bugs (eg Apache and nginx). If there’s one domain that’s seen a lot of competition for security, it’s been web servers.
- deleted 2y ago[deleted]
- johnny22 2y agoI was looking for a web server, not a web framework. A replacement for nginx and caddy, not something to build applications on thus I never would have thought about clicking on a link talking about web frameworks. Anybody have any suggestions beyond the one under discussion?
- adastra22 2y agoDid you click the link? Scroll down to “Server frameworks.”
- deleted 2y ago[deleted]
- ratorx 2y agoI think for this web server to compete with caddy/nginx (if the goal is getting other people to use it, if built for fun, please ignore) this needs a good reason to exist. Memory-safe is nice compared to Nginx, but pretty moot when comparing to Caddy. OTOH, perhaps this could aim for better/comparable performance to Nginx (and better than Caddy) whilst being memory safe? It’s still quite a niche use case though.
- deleted 2y ago[deleted]
- yoavm 2y agoAccording to the landing page, it already outperforms Caddy.
- dorianniemiec 2y agoI will later update the performance benchmark chart, since the current one features an earlier alpha version of my web server (Project Karpacz 0.3.0).
- ratorx 2y ago> performs similarly to a popular Caddy web server From the main landing page. Possibly the benchmarks are slightly better, but until Nginx is added it’s hard to say how significant that bump is.
- hu3 2y agoSo does nginx. Still Caddy keeps eating a slice of nginx pie.
- yoavm 2y agoI suspect that people don't like changing web servers, and perhaps that's why it took the industry so long to move away from Apache. Ferron actually looks great — great performance, automatic TLS, easy reverse proxy configuration and more. Congrats on shipping this!
- dorianniemiec 2y agoThank you for the feedback!
- encom 2y agoWhat's wrong with Apache?
- yoavm 2y agoIt is often slower, harder to configure, and has fewer features than Nginx, Caddy, etc.
- mhitza 2y agoSlower? Yes. But my impression was always that it had more features than nginx. Unless you compare it with the enterprise offering?
- throwaway032023 2y agoOpenresty distribution of nginx with lua scripting is game changer vs. Apache.
- yoavm 2y agoYou are right, I'm talking more about features that the average (modern) user would need, like automatic SSL setup.
- hu3 2y agoYeah it surprised me when Caddy [1] started gaining traction for that reason. It's much better than the old competition in many ways, so there's that. https://caddyserver.com https://caddyserver.com
- Kwpolska 2y agoHow many memory safety issues are found per year in the established servers (Apache and nginx)? Why does the front page benchmark not include nginx?
- deleted 2y ago[deleted]
- pointlessone 2y agoWhy doesn’t benchmark include Ferron itself?
- dorianniemiec 2y agoIt includes an older, alpha version of my web server (Project Karpacz 0.3.0). I will update the benchmark later.
- k_bx 2y agoPlease consider out-of-the-box way to analyze slow queries, analysis by endpoints (ideally with some patterns to group by), ideally to not generate gigabytes of access logs but rather give some already-aggregated in-memory stats. Maybe batteries included would be great (web UI similar to HAProxy but way-way better).
- renox 2y agoThis seems to be a bonafide FOSS project, the correct way to ask for features is either to provide patch or money not this..
- LtdJorge 2y agoSuggesting features is always good
- k_bx 2y agoI am a FOSS developer myself for many years, and this is exactly kind of stuff I'd love to hear. So no, it is totally OK to give your ideas to the developer in this form.
- surajrmal 2y agoKind suggestions are okay. Demands and complaints are not. This doesn't strike me as the latter two.
- gitgud 2y agoThere’s no correct way in FOSS… that’s kinda the point
- eptcyka 2y agoIs it susceptible to slow loris? Hyper, the http library, did not handle it well.
- dorianniemiec 2y agoI haven't tested it for Slowloris yet.
- DeathArrow 2y ago[flagged]
- GrayShade 2y agoI don't mind it, since I like the language, and I'll try to use apps written in Rust when possible. If I see Rust, I know what to expect wrt. resource usage and performance, contributor experience and so on. I'm also willing to test them to "dog-food" the ecosystem.
- rzzzt 2y agoWhat are your performance expectations?
- GrayShade 2y agoBy default, I expect that the performance, memory usage and start-up time of a Rust app to be comparable to an equivalent one written in C or C++. That's still a range of one or two orders of magnitude, but it's still good enough to have an initial idea. For example, there's a popular Python app that used to take 1-2 seconds just to display the help message. It's a little better these days, and I'd use it anyway there's no alternative, but there's no way a Rust version of it would be that slow to start.
- whytevuhuni 2y agoI can think of at least a few things: - Since this is Hacker News, it's likely meant to showcase it to other Rust engineers, or attract contributors - It signals that it is close to C/C++ speeds, but is more memory-safe than C/C++ servers - It shows pride in being able to overcome the borrow checker, which can sometimes be difficult (Rust is more of a language + small formal proof of memory safety, than just a language)
- dorianniemiec 2y agoActually, I spent some time "fighting the borrow checker" when I developed my web server.
- mholt 2y agoAwesome :) Best of luck with the project!
- dorianniemiec 2y agoThank you!
- kennykartman 2y agoI use caddy and I'm quite happy with it over apache and nginx, but I'd happily give my opinion if this helps OP to make this something different and hopefully even better than caddy. I love auto TLS and caddyfiles are easy to understand. Modularity is important and templates can be very useful. Serving files and using caddy as reverse proxy are the most common uses I make of it in production, but I also use caddy in dev and it's a boon. Ease of config means my team can easily pick up my work and continue from there, even if they are not as proficient with the tool. I don't love caddyfile directive ordering: sometimes my colleagues are confused because directives have an implicit order that is not obvious: instead of reordering directives, I'd rather have a warning/error message saying "this config doesn't make sense because you cannot do this and that", or just follow the order used in the config file + warnings. I use it a lot to prototype and mock APIs during development, e.g. to have endpoints returning html pages or json documents: static files and templates are useful for this and I wouldn't consider something without this feature, though go templates aren't that great and/or caddy docs are a bit lacking (e.g. a simple loop over 0,1,2,3... Is not obvious!) I don't find caddy great (or I don't know how to use it) to debug things when they are not working as expected. I often find myself replacing parts of the infra with netcat so that I can inspect what is going on. It would be great to have a "debug endpoint", like a webpage I could connect to and inspect all the traffic like MITM proxy, it would be awesome. Being able to inject myself in a route and manually change headers, responses, requests etc, it would be fantastic and a great help in debugging issues. Also, being able to start this "inspection mode" while in production would be nice, without having to restart the server (something is off -> I ssh-port-forward to the server host -> connect my browser to the server and inspect the errors -> find the issue and fix the config). Management of certs could be improved in some edge cases. For example, I'd be happy if it was easier to manage certs in a private subnet. For example, say host A could acquire certs for my domain example.com with DNS challenge, then a host B, not public facing but in a subnet with A, could ask A to manage its certificates and still have valid https (letsencrypt provided certs) inside the network.
- kennykartman 2y agoAlso, while I love Rust and I'm a big fan of the language, please stop saying "it's made with Rust!". Really, it's only annoying and irrelevant to the quality of a project and it might even be counterproductive. Who cares what language is used for a software as long as it works great ;) This holds in general, not only for this project in particular.
- Bino 2y ago[flagged]
- potsandpans 2y agoWhat does this comment practically add to the discourse of curiosity?
- rayiner 2y agoI’d love your opinion on how you found working with Rust’s memory model for something like a web server. Did your design fit naturally with ownership and borrowing, or did you find yourself fighting the language?
- deleted 2y ago[deleted]
- dorianniemiec 2y agoWhen developing my web server, I spent some time "fighting the borrow checker".