pitchfork 0.7.0 → 0.9.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 05372d35dd4784eb22e204b614b1c7add13fd0e298495543c5395e2f03b42073
-  data.tar.gz: 14f241efeb95774f6de6e9fc8926815eb7f10c25965a09a0700f77dae75dbb92
+  metadata.gz: eb4e22969b9f2c38717f0cfa7a3c966995814156a17589bc06bdc609b7ad6e32
+  data.tar.gz: dbf7833c26ef94962abbd71d66c63e40dd0f7f405ee82951723ad3b4cbfa864f
 SHA512:
-  metadata.gz: f26ebeeb3bc9f7533d25cc41b29a317fb8a80ce108a1859657adfa80b9eb8f88812cfe85dfecf0fbd8093b6e91f45c6ce51ab7b9a15864d96b9d0f5f77835786
-  data.tar.gz: 8d1f09bb24226f2c89b2db2d549c28508a9f2ea716a1612fcc3367d27445657b9d9da281e623af696dc803acd649847a724366306caf672dbc523a3e7495579b
+  metadata.gz: 0f0c029a01bc999d90421fe0ed77f76c6f1e56a9f3ec8eaa4ab6722f40eb0ee7f9aa0f004044e4c97e93a593cdba0d7a6bab01ef6b075440c76012f05e5cccd4
+  data.tar.gz: 4ae4d319ffd2acbf99ad29156622510c951ca095c20074f8415376d6e217be1b959e68e3245590cce62de66f3f8af8f0aae469fec842865dd4dcfe1b060e3db9

data/.devcontainer/devcontainer.json

@@ -0,0 +1,28 @@
+// For format details, see https://aka.ms/devcontainer.json. For config options, see the
+// README at: https://github.com/devcontainers/templates/tree/main/src/ruby
+{
+	"name": "Ruby",
+	// Or use a Dockerfile or Docker Compose file. More info: https://containers.dev/guide/dockerfile
+	"build": {
+			// Path is relative to the devcontainer.json file.
+			"dockerfile": "../Dockerfile"
+	},
+	"features": {
+		"ghcr.io/devcontainers/features/github-cli:1": {}
+	},
+
+	// Features to add to the dev container. More info: https://containers.dev/features.
+	// "features": {},
+
+	// Use 'forwardPorts' to make a list of ports inside the container available locally.
+	// "forwardPorts": [],
+
+	// Use 'postCreateCommand' to run commands after the container is created.
+	"postCreateCommand": "bundle install"
+
+	// Configure tool-specific properties.
+	// "customizations": {},
+
+	// Uncomment to connect as root instead. More info: https://aka.ms/dev-containers-non-root.
+	// "remoteUser": "root"
+}

data/CHANGELOG.md

@@ -1,5 +1,14 @@
 # Unreleased
 
+# 0.9.0
+
+- Implement `spawn_timeout` to protect against bugs causing workers to get stuck before they reach ready state.
+
+# 0.8.0
+
+- Add an `after_monitor_ready` callback, called in the monitor process at end of boot.
+- Implement `Pitchfork.prevent_fork` for use in background threads that synchronize native locks with the GVL released.
+
 # 0.7.0
 
 - Set nicer `proctile` to better see the state of the process tree at a glance.

data/Dockerfile

@@ -1,4 +1,4 @@
-FROM ruby:3.2
+FROM mcr.microsoft.com/devcontainers/ruby:1-3.2-bookworm
 RUN apt-get update -y && apt-get install -y ragel socat netcat-traditional smem apache2-utils
 WORKDIR /app
 CMD [ "bash" ]

data/Gemfile.lock

@@ -1,7 +1,7 @@
 PATH
   remote: .
   specs:
-    pitchfork (0.7.0)
+    pitchfork (0.9.0)
       rack (>= 2.0)
       raindrops (~> 0.7)
 
@@ -10,7 +10,7 @@ GEM
   specs:
     minitest (5.15.0)
     nio4r (2.5.9)
-    puma (6.3.0)
+    puma (6.3.1)
       nio4r (~> 2.0)
     rack (3.0.8)
     raindrops (0.20.1)

data/README.md

@@ -9,13 +9,6 @@ advantage of features in Unix/Unix-like kernels. Slow clients should
 only be served by placing a reverse proxy capable of fully buffering
 both the request and response in between `pitchfork` and slow clients.
 
-## Disclaimer
-
-Until this notice is removed from the README, `pitchfork` should be
-considered experimental. As such it is not encouraged to run it in
-production just yet unless you feel capable of debugging yourself
-any issue that may arise.
-
 ## Features
 
 * Designed for Rack, Linux, fast clients, and ease-of-debugging. We
@@ -40,9 +33,23 @@ any issue that may arise.
   or ports yourself. `pitchfork` can spawn and manage any number of
   worker processes you choose to scale to your backend.
 
+* Adaptative timeout: request timeout can be extended dynamically on a
+  per request basis, which allows to keep a strict overall timeout for
+  most endpoints, but allow a few endpoints to take longer.
+
 * Load balancing is done entirely by the operating system kernel.
   Requests never pile up behind a busy worker process.
 
+## When to Use
+
+Pitchfork isn't inherently better than other Ruby application servers, it mostly
+focus on different tradeoffs.
+
+If you are fine with your current server, it's best to stick with it.
+
+If there is a problem you are trying to solve, please read the
+[migration guide](docs/WHY_MIGRATE.md) first.
+
 ## Requirements
 
 Ruby(MRI) Version 2.5 and above.

data/docs/CONFIGURATION.md

@@ -238,6 +238,19 @@ exit or be SIGKILL-ed due to timeouts.
 See https://nginx.org/en/docs/http/ngx_http_upstream_module.html
 for more details on nginx upstream configuration.
 
+### `spawn_timeout`
+
+```ruby
+timeout 5
+```
+
+Sets the timeout for a newly spawned worker to be ready after being spawned.
+
+This timeout is a safeguard against various low-level fork safety bugs that could cause
+a process to dead-lock.
+
+The default of `10` seconds is quite generous and likely doesn't need to be adjusted.
+
 ### `logger`
 
 ```ruby
@@ -253,12 +266,23 @@ The default Logger will log its output to STDERR.
 Because pitchfork several callbacks around the lifecycle of workers.
 It is often necessary to use these callbacks to close inherited connection after fork.
 
-Note that when reforking is available, the `pitchfork` master process won't load your application
-at all. As such for hooks executed in the master, you may need to explicitly load the parts of your
+Note that when reforking is available, the `pitchfork` monitor process won't load your application
+at all. As such for hooks executed in the monitor, you may need to explicitly load the parts of your
 application that are used in hooks.
 
 `pitchfork` also don't attempt to rescue hook errors. Raising from a worker hook will crash the worker,
-and raising from a master hook will bring the whole cluster down.
+and raising from a monitor hook will bring the whole cluster down.
+
+### `after_monitor_ready`
+
+Called by the monitor process after it's done booting the application and
+spawning the original workers.
+
+```ruby
+after_monitor_ready do |server|
+  server.logger.info("Monitor pid=#{Process.pid} ready")
+end
+```
 
 ### `after_mold_fork`
 
@@ -338,7 +362,7 @@ By default the cleanup timeout is 2 seconds.
 
 ### `after_worker_hard_timeout`
 
-Called in the master process when a worker hard timeout is elapsed:
+Called in the monitor process when a worker hard timeout is elapsed:
 
 ```ruby
 after_worker_timeout do |server, worker|
@@ -353,7 +377,7 @@ soft timeout from working.
 
 ### `after_worker_exit`
 
-Called in the master process after a worker exits.
+Called in the monitor process after a worker exits.
 
 ```ruby
 after_worker_exit do |server, worker, status|

data/docs/WHY_MIGRATE.md

@@ -0,0 +1,93 @@
+# Why migrate to Pitchfork?
+
+First and foremost, if you don't have any specific problem with your current server, then don't.
+
+Pitchfork isn't a silver bullet, it's a very opinionated software that focus on very specific tradeoffs,
+that are different from other servers.
+
+## Coming from Unicorn
+
+### Why Migrate?
+
+#### Adaptative timeout
+
+Pitchfork allows to extend the request timeout on a per request basis,
+this can be helpful when trying to reduce the global request timeout
+to a saner value. You can enforce a stricter value, and extend it
+in the minority of offending endpoints.
+
+#### Memory Usage - Reforking
+
+If you are unsatisfied with Unicorn memory usage, but threaded Puma isn't an option
+for you, then Pitchfork may be an option if you are able to enable reforking.
+
+However be warned that making an application fork safe can be non-trivial,
+and mistakes can lead to critical bugs.
+
+#### Rack 3
+
+As of Unicorn `6.1.0`, Rack 3 isn't yet supported by Unicorn.
+
+Pitchfork is compatible with Rack 3.
+
+### Why Not Migrate?
+
+#### Reduced Features
+
+While Pitchfork started as a fork of Unicorn, many features such as daemonization,
+pid file management, hot reload have been stripped.
+
+Pitchfork only kept features that makes sense in a containerized world.
+
+## Coming from Puma
+
+Generally speaking, compared to (threaded) Puma, Pitchfork *may* offer better latency and isolation at the expense of throughput.
+
+### Why Migrate?
+
+#### Latency
+
+If you suspect your application is subject to contention on the GVL or some other in-process shared resources,
+then Pitchfork may offer improved latency.
+
+It is however heavily recommended to first confirm this suspicion with profiling
+tools such as [gvltools](https://github.com/Shopify/gvltools).
+
+If you application isn't subject to in-process contention, Pitchfork is unlikely to improve latency.
+
+#### Out of Band Garbage Collection
+
+Another advantage of only processing a single request per process is that
+[it allows to periodically trigger garbage collection when the worker isn't processing any request](https://shopify.engineering/adventures-in-garbage-collection).
+
+This can significantly improve tail latency at the expense of throughput.
+
+#### Resiliency and Isolation
+
+Since Pitchfork workers have their own address space and only process one request at a time
+it makes it much harder for one faulty request to impact another.
+
+Even if a bug causes Ruby to crash, only the request that triggered the bug will be impacted.
+
+If a bug causes Ruby to hang, the monitor process will SIGKILL the worker and the capacity will be
+reclaimed.
+
+This makes Pitchfork more resilient to some classes of bugs.
+
+#### Thread Safety
+
+Pitchfork doesn't require applications to be thread-safe. That is probably the worst reason
+to migrate though.
+
+### Why Not Migrate?
+
+#### Memory Usage
+
+Without reforking enabled Pitchfork will without a doubt use more memory than threaded Puma.
+
+With reforking enabled, results will vary based on the application profile and the number of Puma threads,
+but should be in the same ballpark, sometimes better, but likely worse, this depends on many variables and
+can't really be predicted.
+
+However be warned that [making an application fork safe](FORK_SAFETY.md) can be non-trivial,
+and mistakes can lead to critical bugs.

data/lib/pitchfork/configurator.rb

@@ -33,6 +33,7 @@ module Pitchfork
     DEFAULTS = {
       :soft_timeout => 20,
       :cleanup_timeout => 2,
+      :spawn_timeout => 10,
       :timeout => 22,
       :logger => default_logger,
       :worker_processes => 1,
@@ -60,6 +61,9 @@ module Pitchfork
       :after_worker_ready => lambda { |server, worker|
         server.logger.info("worker=#{worker.nr} gen=#{worker.generation} ready")
       },
+      :after_monitor_ready => lambda { |server|
+        server.logger.info("Monitor pid=#{Process.pid} ready")
+      },
       :after_worker_timeout => nil,
       :after_worker_hard_timeout => nil,
       :after_request_complete => nil,
@@ -141,6 +145,10 @@ module Pitchfork
       set_hook(:after_worker_ready, block_given? ? block : args[0])
     end
 
+    def after_monitor_ready(*args, &block)
+      set_hook(:after_monitor_ready, block_given? ? block : args[0], 1)
+    end
+
     def after_worker_timeout(*args, &block)
       set_hook(:after_worker_timeout, block_given? ? block : args[0], 3)
     end
@@ -167,6 +175,10 @@ module Pitchfork
       set_int(:timeout, soft_timeout + cleanup_timeout, 5)
     end
 
+    def spawn_timeout(seconds)
+      set_int(:spawn_timeout, seconds, 1)
+    end
+
     def worker_processes(nr)
       set_int(:worker_processes, nr, 1)
     end

data/lib/pitchfork/http_server.rb

@@ -74,13 +74,13 @@ module Pitchfork
     end
 
     # :stopdoc:
-    attr_accessor :app, :timeout, :soft_timeout, :cleanup_timeout, :worker_processes,
+    attr_accessor :app, :timeout, :soft_timeout, :cleanup_timeout, :spawn_timeout, :worker_processes,
                   :after_worker_fork, :after_mold_fork,
                   :listener_opts, :children,
                   :orig_app, :config, :ready_pipe,
                   :default_middleware, :early_hints
     attr_writer   :after_worker_exit, :before_worker_exit, :after_worker_ready, :after_request_complete,
-                  :refork_condition, :after_worker_timeout, :after_worker_hard_timeout
+                  :refork_condition, :after_worker_timeout, :after_worker_hard_timeout, :after_monitor_ready
 
     attr_reader :logger
     include Pitchfork::SocketHelper
@@ -212,6 +212,8 @@ module Pitchfork
         wait_for_pending_workers
       end
 
+      @after_monitor_ready&.call(self)
+
       self
     end
 
@@ -554,6 +556,10 @@ module Pitchfork
     def spawn_worker(worker, detach:)
       logger.info("worker=#{worker.nr} gen=#{worker.generation} spawning...")
 
+      # We set the deadline before spawning the child so that if for some
+      # reason it gets stuck before reaching the worker loop,
+      # the monitor process will kill it.
+      worker.update_deadline(@spawn_timeout)
       Pitchfork.fork_sibling do
         worker.pid = Process.pid
 

data/lib/pitchfork/info.rb

@@ -6,14 +6,35 @@ module Pitchfork
   module Info
     @workers_count = 0
     @fork_safe = true
-    @kept_ios = ObjectSpace::WeakMap.new
+
+    class WeakSet # :nodoc
+      def initialize
+        @map = ObjectSpace::WeakMap.new
+      end
+
+      if RUBY_VERSION < "2.7"
+        def <<(object)
+          @map[object] = object
+        end
+      else
+        def <<(object)
+          @map[object] = true
+        end
+      end
+
+      def each(&block)
+        @map.each_key(&block)
+      end
+    end
+    
+    @kept_ios = WeakSet.new
 
     class << self
       attr_accessor :workers_count
 
       def keep_io(io)
         raise ArgumentError, "#{io.inspect} doesn't respond to :to_io" unless io.respond_to?(:to_io)
-        @kept_ios[io] = io
+        @kept_ios << io
         io
       end
 
@@ -22,20 +43,14 @@ module Pitchfork
       end
 
       def close_all_ios!
-        ignored_ios = [$stdin, $stdout, $stderr]
+        ignored_ios = [$stdin, $stdout, $stderr, STDIN, STDOUT, STDERR].uniq.compact
 
-        @kept_ios.each_value do |io_like|
+        @kept_ios.each do |io_like|
           ignored_ios << (io_like.is_a?(IO) ? io_like : io_like.to_io)
         end
 
         ObjectSpace.each_object(IO) do |io|
-          closed = begin
-            io.closed?
-          rescue IOError
-            true
-          end
-
-          if !closed && io.autoclose? && !ignored_ios.include?(io)
+          if io_open?(io) && io_autoclosed?(io) && !ignored_ios.include?(io)
             if io.is_a?(TCPSocket)
               # If we inherited a TCP Socket, calling #close directly could send FIN or RST.
               # So we first reopen /dev/null to avoid that.
@@ -73,6 +88,20 @@ module Pitchfork
       def shutting_down?
         SharedMemory.shutting_down?
       end
+
+      private
+
+      def io_open?(io)
+        !io.closed?
+      rescue IOError
+        false
+      end
+
+      def io_autoclosed?(io)
+        io.autoclose?
+      rescue IOError
+        false
+      end
     end
   end
 end

data/lib/pitchfork/version.rb

@@ -1,7 +1,7 @@
 # frozen_string_literal: true
 
 module Pitchfork
-  VERSION = "0.7.0"
+  VERSION = "0.9.0"
   module Const
     UNICORN_VERSION = '6.1.0'
   end

data/lib/pitchfork.rb

@@ -36,157 +36,190 @@ module Pitchfork
 
   # :stopdoc:
 
-  # This returns a lambda to pass in as the app, this does not "build" the
-  # app The returned lambda will be called when it is
-  # time to build the app.
-  def self.builder(ru, op)
-    # allow Configurator to parse cli switches embedded in the ru file
-    op = Pitchfork::Configurator::RACKUP.merge!(:file => ru, :optparse => op)
-    if ru =~ /\.ru$/ && !defined?(Rack::Builder)
-      abort "rack and Rack::Builder must be available for processing #{ru}"
+  FORK_LOCK = Monitor.new
+  @socket_type = :SOCK_SEQPACKET
+
+  class << self
+    # :startdoc:
+
+    # Prevent Pitchfork from forking new children for the duration of the block.
+    #
+    # If you have background threads calling code that synchronize native locks,
+    # while the GVL is released, forking while they are held could leak to
+    # corrupted children.
+    #
+    # One example of this is `getaddrinfo(3)`, so opening a connection from a
+    # background thread has a chance to produce stuck children.
+    #
+    # To avoid this you can wrap such code in `Pitchfork.prevent_fork`:
+    #
+    # def heartbeat_thread
+    #   @heartbeat_thread ||= Thread.new do
+    #     loop do
+    #       Pitchfork.prevent_fork do
+    #         heartbeat
+    #       end
+    #       sleep 10
+    #     end
+    #   end
+    # end
+    #
+    def prevent_fork(&block)
+      FORK_LOCK.synchronize(&block)
     end
 
-    # always called after config file parsing, may be called after forking
-    lambda do |_, server|
-      inner_app = case ru
-      when /\.ru$/
-        raw = File.read(ru)
-        raw.sub!(/^__END__\n.*/, '')
-        eval("Rack::Builder.new {(\n#{raw}\n)}.to_app", TOPLEVEL_BINDING, ru)
-      else
-        require ru
-        Object.const_get(File.basename(ru, '.rb').capitalize)
+    # :stopdoc:
+
+    # This returns a lambda to pass in as the app, this does not "build" the
+    # app The returned lambda will be called when it is
+    # time to build the app.
+    def builder(ru, op)
+      # allow Configurator to parse cli switches embedded in the ru file
+      op = Pitchfork::Configurator::RACKUP.merge!(:file => ru, :optparse => op)
+      if ru =~ /\.ru$/ && !defined?(Rack::Builder)
+        abort "rack and Rack::Builder must be available for processing #{ru}"
       end
 
-      Rack::Builder.new do
-        use(Rack::ContentLength)
-        use(Pitchfork::Chunked)
-        use(Rack::Lint) if ENV["RACK_ENV"] == "development"
-        use(Rack::TempfileReaper)
-        run inner_app
-      end.to_app
+      # always called after config file parsing, may be called after forking
+      lambda do |_, server|
+        inner_app = case ru
+        when /\.ru$/
+          raw = File.read(ru)
+          raw.sub!(/^__END__\n.*/, '')
+          eval("Rack::Builder.new {(\n#{raw}\n)}.to_app", TOPLEVEL_BINDING, ru)
+        else
+          require ru
+          Object.const_get(File.basename(ru, '.rb').capitalize)
+        end
+
+        Rack::Builder.new do
+          use(Rack::ContentLength)
+          use(Pitchfork::Chunked)
+          use(Rack::Lint) if ENV["RACK_ENV"] == "development"
+          use(Rack::TempfileReaper)
+          run inner_app
+        end.to_app
+      end
     end
-  end
 
-  # returns an array of strings representing TCP listen socket addresses
-  # and Unix domain socket paths.  This is useful for use with
-  # Raindrops::Middleware under Linux: https://yhbt.net/raindrops/
-  def self.listener_names
-    Pitchfork::HttpServer::LISTENERS.map do |io|
-      Pitchfork::SocketHelper.sock_name(io)
+    # returns an array of strings representing TCP listen socket addresses
+    # and Unix domain socket paths.  This is useful for use with
+    # Raindrops::Middleware under Linux: https://yhbt.net/raindrops/
+    def listener_names
+      Pitchfork::HttpServer::LISTENERS.map do |io|
+        Pitchfork::SocketHelper.sock_name(io)
+      end
     end
-  end
 
-  def self.log_error(logger, prefix, exc)
-    message = exc.message
-    message = message.dump if /[[:cntrl:]]/ =~ message
-    logger.error "#{prefix}: #{message} (#{exc.class})"
-    exc.backtrace.each { |line| logger.error(line) }
-  end
+    def log_error(logger, prefix, exc)
+      message = exc.message
+      message = message.dump if /[[:cntrl:]]/ =~ message
+      logger.error "#{prefix}: #{message} (#{exc.class})"
+      exc.backtrace.each { |line| logger.error(line) }
+    end
 
-  F_SETPIPE_SZ = 1031 if RUBY_PLATFORM =~ /linux/
-
-  def self.pipe # :nodoc:
-    IO.pipe.each do |io|
-      # shrink pipes to minimize impact on /proc/sys/fs/pipe-user-pages-soft
-      # limits.
-      if defined?(F_SETPIPE_SZ)
-        begin
-          io.fcntl(F_SETPIPE_SZ, Raindrops::PAGE_SIZE)
-        rescue Errno::EINVAL
-          # old kernel
-        rescue Errno::EPERM
-          # resizes fail if Linux is close to the pipe limit for the user
-          # or if the user does not have permissions to resize
+    F_SETPIPE_SZ = 1031 if RUBY_PLATFORM =~ /linux/
+
+    def pipe # :nodoc:
+      IO.pipe.each do |io|
+        # shrink pipes to minimize impact on /proc/sys/fs/pipe-user-pages-soft
+        # limits.
+        if defined?(F_SETPIPE_SZ)
+          begin
+            io.fcntl(F_SETPIPE_SZ, Raindrops::PAGE_SIZE)
+          rescue Errno::EINVAL
+            # old kernel
+          rescue Errno::EPERM
+            # resizes fail if Linux is close to the pipe limit for the user
+            # or if the user does not have permissions to resize
+          end
         end
       end
     end
-  end
 
-  @socket_type = :SOCK_SEQPACKET
-  def self.socketpair
-    pair = UNIXSocket.socketpair(@socket_type).map { |s| MessageSocket.new(s) }
-    pair[0].close_write
-    pair[1].close_read
-    pair
-  rescue Errno::EPROTONOSUPPORT
-    if @socket_type == :SOCK_SEQPACKET
-      # macOS and very old linuxes don't support SOCK_SEQPACKET (SCTP).
-      # In such case we can fallback to SOCK_STREAM (TCP)
-      warn("SEQPACKET (SCTP) isn't supported, falling back to STREAM")
-      @socket_type = :SOCK_STREAM
-      retry
-    else
-      raise
+    def socketpair
+      pair = UNIXSocket.socketpair(@socket_type).map { |s| MessageSocket.new(s) }
+      pair[0].close_write
+      pair[1].close_read
+      pair
+    rescue Errno::EPROTONOSUPPORT
+      if @socket_type == :SOCK_SEQPACKET
+        # macOS and very old linuxes don't support SOCK_SEQPACKET (SCTP).
+        # In such case we can fallback to SOCK_STREAM (TCP)
+        warn("SEQPACKET (SCTP) isn't supported, falling back to STREAM")
+        @socket_type = :SOCK_STREAM
+        retry
+      else
+        raise
+      end
     end
-  end
 
-  def self.clean_fork(setpgid: true, &block)
-    if pid = Process.fork
-      if setpgid
-        Process.setpgid(pid, pid) # Make into a group leader
+    def clean_fork(setpgid: true, &block)
+      if pid = FORK_LOCK.synchronize { Process.fork }
+        if setpgid
+          Process.setpgid(pid, pid) # Make into a group leader
+        end
+        return pid
       end
-      return pid
-    end
 
-    begin
-      # Pitchfork recursively refork the worker processes.
-      # Because of this we need to unwind the stack before resuming execution
-      # in the child, otherwise on each generation the available stack space would
-      # get smaller and smaller until it's basically 0.
-      #
-      # The very first version of this method used to call fork from a new
-      # thread, however this can cause issues with some native gems that rely on
-      # pthread_atfork(3) or pthread_mutex_lock(3), as the new main thread would
-      # now be different.
-      #
-      # A second version used to fork from a new fiber, but fibers have a much smaller
-      # stack space (https://bugs.ruby-lang.org/issues/3187), so it would break large applications.
-      #
-      # The latest version now use `throw` to unwind the stack after the fork, it however
-      # restrict it to be called only inside `handle_clean_fork`.
-      if Thread.current[:pitchfork_handle_clean_fork]
-        throw self, block
-      else
-        while block
-          block = catch(self) do
-            Thread.current[:pitchfork_handle_clean_fork] = true
-            block.call
-            nil
+      begin
+        # Pitchfork recursively refork the worker processes.
+        # Because of this we need to unwind the stack before resuming execution
+        # in the child, otherwise on each generation the available stack space would
+        # get smaller and smaller until it's basically 0.
+        #
+        # The very first version of this method used to call fork from a new
+        # thread, however this can cause issues with some native gems that rely on
+        # pthread_atfork(3) or pthread_mutex_lock(3), as the new main thread would
+        # now be different.
+        #
+        # A second version used to fork from a new fiber, but fibers have a much smaller
+        # stack space (https://bugs.ruby-lang.org/issues/3187), so it would break large applications.
+        #
+        # The latest version now use `throw` to unwind the stack after the fork, it however
+        # restrict it to be called only inside `handle_clean_fork`.
+        if Thread.current[:pitchfork_handle_clean_fork]
+          throw self, block
+        else
+          while block
+            block = catch(self) do
+              Thread.current[:pitchfork_handle_clean_fork] = true
+              block.call
+              nil
+            end
           end
         end
+      rescue
+        abort
+      else
+        exit
       end
-    rescue
-      abort
-    else
-      exit
     end
-  end
 
-  def self.fork_sibling(&block)
-    if REFORKING_AVAILABLE
-      # We double fork so that the new worker is re-attached back
-      # to the master.
-      # This requires either PR_SET_CHILD_SUBREAPER which is exclusive to Linux 3.4
-      # or the master to be PID 1.
-      if middle_pid = Process.fork # parent
-        # We need to wait(2) so that the middle process doesn't end up a zombie.
-        Process.wait(middle_pid)
-      else # first child
-        clean_fork(&block) # detach into a grand child
-        exit
+    def fork_sibling(&block)
+      if REFORKING_AVAILABLE
+        # We double fork so that the new worker is re-attached back
+        # to the master.
+        # This requires either PR_SET_CHILD_SUBREAPER which is exclusive to Linux 3.4
+        # or the master to be PID 1.
+        if middle_pid = FORK_LOCK.synchronize { Process.fork } # parent
+          # We need to wait(2) so that the middle process doesn't end up a zombie.
+          Process.wait(middle_pid)
+        else # first child
+          clean_fork(&block) # detach into a grand child
+          exit
+        end
+      else
+        clean_fork(&block)
       end
-    else
-      clean_fork(&block)
-    end
 
-    nil # it's tricky to return the PID
-  end
+      nil # it's tricky to return the PID
+    end
 
-  def self.time_now(int = false)
-    Process.clock_gettime(Process::CLOCK_MONOTONIC, int ? :second : :float_second)
+    def time_now(int = false)
+      Process.clock_gettime(Process::CLOCK_MONOTONIC, int ? :second : :float_second)
+    end
   end
-  # :startdoc:
 end
 # :enddoc:
 

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: pitchfork
 version: !ruby/object:Gem::Version
-  version: 0.7.0
+  version: 0.9.0
 platform: ruby
 authors:
 - Jean Boussier
 autorequire:
 bindir: exe
 cert_chain: []
-date: 2023-08-18 00:00:00.000000000 Z
+date: 2023-09-28 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: raindrops
@@ -49,6 +49,7 @@ extensions:
 - ext/pitchfork_http/extconf.rb
 extra_rdoc_files: []
 files:
+- ".devcontainer/devcontainer.json"
 - ".git-blame-ignore-revs"
 - ".gitattributes"
 - ".github/workflows/ci.yml"
@@ -71,6 +72,7 @@ files:
 - docs/REFORKING.md
 - docs/SIGNALS.md
 - docs/TUNING.md
+- docs/WHY_MIGRATE.md
 - examples/constant_caches.ru
 - examples/echo.ru
 - examples/hello.ru