httpd-dev mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "Steinar H. Gunderson" <sgunder...@bigfoot.com>
Subject Inclusion of mpm-itk into HEAD
Date Sun, 17 Jun 2007 19:47:33 GMT
[Please Cc me on any replies, I'm not subscribed to the list]

Hi,

I'd like to request the inclusion of the ITK MPM (mpm-itk) as an official MPM
in the Apache tree, for Apache 2.4/3.0. mpm-itk is basically a modified
prefork allowing each vhost to run as a different uid/gid, ie. sort of like
what perchild was supposed to do. The biggest differences between mpm-itk and
perchild/Metux/peruser are:

 - mpm-itk is in production use at several sites -- for instance, most sites
   under .ntnu.no generally use mpm-itk, totaling about nine million hits a
   day. Even though it is still under experimental/ in the tree, most real
   issues have long since been ironed out -- it is not a proof-of-concept,
   but a real, working tool. It works flawlessly with SSL and most
   third-party modules (mod_ruby being a notable exception).
 - mpm-itk is not threaded, which means you can run the full range of evil
   third-party modules (such as PHP and its extensions) without problems.
 - mpm-itk does not require any sort of special kernel modules or
   configuration. It should generally work on the same platforms as prefork
   does, given that it's a direct prefork descendent. It's a pluggable
   replacement for prefork; most sites wouldn't really notice the difference
   if you took out prefork and replaced it with mpm-itk, until you start
   actually using AssignUserID. This provides a smooth migration path.

Two main disadvantages should be noted:

 - setuid() happens after the request has been parsed, which means that the
   server runs as root up until that point. (However, on a system with
   capabilities, ie. Linux 2.6, almost all superuser privileges are dropped,
   so you can't just load kernel code or whatever.)
 - There is a performance drop from prefork, as each child is only serving
   one connection before it dies -- I haven't done any detailed benchmarking
   on this, but my general impression is: If you're serving static content
   and you're strained for performance, it matters. If you're serving dynamic
   content or large static files, it probably just disappears in the equation.

Despite these disadvantages, I believe it would be a useful addition to the
upstream tree -- these are largely results of design decisions in order to
keep the design as close to prefork as possible, instead of designing a new
grand scheme that will take a lot of time to get right. mpm-itk is included
in at least Debian, Ubuntu, Gentoo, and in FreeBSD ports, and based on the
numbers from Debian's popularity contest (which is not a statistically valid
sample, but nevertheless a good indication) is the third most popular MPM
(after prefork and worker, but clearly ahead of event).

The full set of patches, against Apache 2.2.3, is available from

  http://home.samfundet.no/~sesse/mpm-itk/apache2.2-mpm-itk-2.2.3-04/

I'll of course be happy to update these to apply against HEAD if needed,
transfer copyright to the ASF, and write any needed documentation. However,
given that the "runs as root" issue has proved somewhat controversial
earlier, I don't think it's appropriate to do that kind of upstream
integration work before some kind of decision has been made :-)

/* Steinar */
-- 
Homepage: http://www.sesse.net/

Mime
View raw message