puma 6.4.1 → 7.2.1

data/README.md

@@ -4,15 +4,14 @@
 
 # Puma: A Ruby Web Server Built For Parallelism
 
-[![Actions](https://github.com/puma/puma/workflows/Tests/badge.svg?branch=master)](https://github.com/puma/puma/actions?query=workflow%3ATests)
-[![Code Climate](https://codeclimate.com/github/puma/puma.svg)](https://codeclimate.com/github/puma/puma)
+[![Actions](https://github.com/puma/puma/actions/workflows/tests.yml/badge.svg?branch=main)](https://github.com/puma/puma/actions/workflows/tests.yml?query=branch%3Amain)
 [![StackOverflow](https://img.shields.io/badge/stackoverflow-Puma-blue.svg)]( https://stackoverflow.com/questions/tagged/puma )
 
 Puma is a **simple, fast, multi-threaded, and highly parallel HTTP 1.1 server for Ruby/Rack applications**.
 
 ## Built For Speed & Parallelism
 
-Puma is a server for [Rack](https://github.com/rack/rack)-powered HTTP applications written in Ruby.  It is: 
+Puma is a server for [Rack](https://github.com/rack/rack)-powered HTTP applications written in Ruby.  It is:
 * **Multi-threaded**. Each request is served in a separate thread. This helps you serve more requests per second with less memory use.
 * **Multi-process**. "Pre-forks" in cluster mode, using less memory per-process thanks to copy-on-write memory.
 * **Standalone**. With SSL support, zero-downtime rolling restarts and a built-in request bufferer, you can deploy Puma without any reverse proxy.
@@ -82,10 +81,10 @@ $ bundle exec puma
 
 ## Configuration
 
-Puma provides numerous options. Consult `puma -h` (or `puma --help`) for a full list of CLI options, or see `Puma::DSL` or [dsl.rb](https://github.com/puma/puma/blob/master/lib/puma/dsl.rb).
+Puma provides numerous options. Consult `puma -h` (or `puma --help`) for a full list of CLI options, or see `Puma::DSL` or [dsl.rb](https://github.com/puma/puma/blob/main/lib/puma/dsl.rb).
 
 You can also find several configuration examples as part of the
-[test](https://github.com/puma/puma/tree/master/test/config) suite.
+[test](https://github.com/puma/puma/tree/main/test/config) suite.
 
 For debugging purposes, you can set the environment variable `PUMA_LOG_CONFIG` with a value
 and the loaded configuration will be printed as part of the boot process.
@@ -102,9 +101,9 @@ Puma will automatically scale the number of threads, from the minimum until it c
 
 Be aware that additionally Puma creates threads on its own for internal purposes (e.g. handling slow clients). So, even if you specify -t 1:1, expect around 7 threads created in your application.
 
-### Clustered mode
+### Cluster mode
 
-Puma also offers "clustered mode". Clustered mode `fork`s workers from a master process. Each child process still has its own thread pool. You can tune the number of workers with the `-w` (or `--workers`) flag:
+Puma also offers "cluster mode". Cluster mode `fork`s workers from a master process. Each child process still has its own thread pool. You can tune the number of workers with the `-w` (or `--workers`) flag:
 
 ```
 $ puma -t 8:32 -w 3
@@ -116,13 +115,24 @@ Or with the `WEB_CONCURRENCY` environment variable:
 $ WEB_CONCURRENCY=3 puma -t 8:32
 ```
 
-Note that threads are still used in clustered mode, and the `-t` thread flag setting is per worker, so `-w 2 -t 16:16` will spawn 32 threads in total, with 16 in each worker process.
+When using a config file, most applications can simply set `workers :auto` (requires the `concurrent-ruby` gem) to match the number of worker processes to the available processors:
 
-For an in-depth discussion of the tradeoffs of thread and process count settings, [see our docs](https://github.com/puma/puma/blob/9282a8efa5a0c48e39c60d22ca70051a25df9f55/docs/kubernetes.md#workers-per-pod-and-other-config-issues).
+```ruby
+# config/puma.rb
+workers :auto
+```
+
+See [`workers :auto` gotchas](lib/puma/dsl.rb).
+
+Note that threads are still used in cluster mode, and the `-t` thread flag setting is per worker, so `-w 2 -t 16:16` will spawn 32 threads in total, with 16 in each worker process.
+
+If `workers` is set to `:auto`, or the `WEB_CONCURRENCY` environment variable is set to `"auto"`, and the `concurrent-ruby` gem is available in your application, Puma will set the worker process count to the result of [available processors](https://msp-greg.github.io/concurrent-ruby/Concurrent.html#available_processor_count-class_method).
 
-In clustered mode, Puma can "preload" your application. This loads all the application code *prior* to forking. Preloading reduces total memory usage of your application via an operating system feature called [copy-on-write](https://en.wikipedia.org/wiki/Copy-on-write).
+For an in-depth discussion of the tradeoffs of thread and process count settings, [see our docs](docs/deployment.md).
 
-If the `WEB_CONCURRENCY` environment variable is set to a value > 1 (and `--prune-bundler` has not been specified), preloading will be enabled by default. Otherwise, you can use the `--preload` flag from the command line:
+In cluster mode, Puma can "preload" your application. This loads all the application code *prior* to forking. Preloading reduces total memory usage of your application via an operating system feature called [copy-on-write](https://en.wikipedia.org/wiki/Copy-on-write).
+
+If the number of workers is greater than 1 (and `--prune-bundler` has not been specified), preloading will be enabled by default. Otherwise, you can use the `--preload` flag from the command line:
 
 ```
 $ puma -w 3 --preload
@@ -138,51 +148,106 @@ preload_app!
 
 Preloading can’t be used with phased restart, since phased restart kills and restarts workers one-by-one, and preloading copies the code of master into the workers.
 
-When using clustered mode, you can specify a block in your configuration file that will be run on boot of each worker:
+#### Cluster mode hooks
+
+When using clustered mode, Puma's configuration DSL provides `before_fork`, `before_worker_boot`, and `after_worker_shutdown`
+hooks to run code when the master process forks, the child workers are booted, and after each child worker exits respectively.
+
+It is recommended to use these hooks with `preload_app!`, otherwise constants loaded by your
+application (such as `Rails`) will not be available inside the hooks.
 
 ```ruby
 # config/puma.rb
-on_worker_boot do
-  # configuration here
+before_fork do
+  # Add code to run inside the Puma master process before it forks a worker child.
 end
-```
 
-This code can be used to setup the process before booting the application, allowing
-you to do some Puma-specific things that you don't want to embed in your application.
-For instance, you could fire a log notification that a worker booted or send something to statsd. This can be called multiple times.
+before_worker_boot do
+  # Add code to run inside the Puma worker process after forking.
+end
 
-Constants loaded by your application (such as `Rails`) will not be available in `on_worker_boot`
-unless preloading is enabled.
+after_worker_shutdown do |worker_handle|
+  # Add code to run inside the Puma master process after a worker exits. `worker.process_status` can be used to get the
+  # `Process::Status` of the exited worker.
+end
+```
 
-You can also specify a block to be run before workers are forked, using `before_fork`:
+In addition, there is an `before_refork` and `after_refork` hooks which are used only in [`fork_worker` mode](docs/fork_worker.md),
+when the worker 0 child process forks a grandchild worker:
 
 ```ruby
-# config/puma.rb
-before_fork do
-  # configuration here
+before_refork do
+  # Used only when fork_worker mode is enabled. Add code to run inside the Puma worker 0
+  # child process before it forks a grandchild worker.
 end
 ```
 
-You can also specify a block to be run after puma is booted using `on_booted`:
+```ruby
+after_refork do
+  # Used only when fork_worker mode is enabled. Add code to run inside the Puma worker 0
+  # child process after it forks a grandchild worker.
+end
+```
+
+Importantly, note the following considerations when Ruby forks a child process:
+
+1. File descriptors such as network sockets **are** copied from the parent to the forked
+   child process. Dual-use of the same sockets by parent and child will result in I/O conflicts
+   such as `SocketError`, `Errno::EPIPE`, and `EOFError`.
+2. Background Ruby threads, including threads used by various third-party gems for connection
+   monitoring, etc., are **not** copied to the child process. Often this does not cause
+   immediate problems until a third-party connection goes down, at which point there will
+   be no supervisor to reconnect it.
+
+Therefore, we recommend the following:
+
+1. If possible, do not establish any socket connections (HTTP, database connections, etc.)
+   inside Puma's master process when booting.
+2. If (1) is not possible, use `before_fork` and `before_refork` to disconnect the parent's socket
+   connections when forking, so that they are not accidentally copied to the child process.
+3. Use `before_worker_boot` to restart any background threads on the forked child.
+4. Use `after_refork` to restart any background threads on the parent.
+
+#### Master process lifecycle hooks
+
+Puma's configuration DSL provides master process lifecycle hooks `after_booted`, `before_restart`, and `after_stopped`
+which may be used to specify code blocks to run on each event:
 
 ```ruby
 # config/puma.rb
-on_booted do
-  # configuration here
+after_booted do
+  # Add code to run in the Puma master process after it boots,
+  # and also after a phased restart completes.
+end
+
+before_restart do
+  # Add code to run in the Puma master process when it receives
+  # a restart command but before it restarts.
+end
+
+after_stopped do
+  # Add code to run in the Puma master process when it receives
+  # a stop command but before it shuts down.
 end
 ```
 
 ### Error handling
 
-If puma encounters an error outside of the context of your application, it will respond with a 500 and a simple
-textual error message (see `Puma::Server#lowlevel_error` or [server.rb](https://github.com/puma/puma/blob/master/lib/puma/server.rb)).
+If Puma encounters an error outside of the context of your application, it will respond with a 400/500 and a simple
+textual error message (see `Puma::Server#lowlevel_error` or [server.rb](https://github.com/puma/puma/blob/main/lib/puma/server.rb)).
 You can specify custom behavior for this scenario. For example, you can report the error to your third-party
 error-tracking service (in this example, [rollbar](https://rollbar.com)):
 
 ```ruby
-lowlevel_error_handler do |e|
-  Rollbar.critical(e)
-  [500, {}, ["An error has occurred, and engineers have been informed. Please reload the page. If you continue to have problems, contact support@example.com\n"]]
+lowlevel_error_handler do |e, env, status|
+  if status == 400
+    message = "The server could not process the request due to an error, such as an incorrectly typed URL, malformed syntax, or a URL that contains illegal characters.\n"
+  else
+    message = "An error has occurred, and engineers have been informed. Please reload the page. If you continue to have problems, contact support@example.com\n"
+    Rollbar.critical(e)
+  end
+
+  [status, {}, [message]]
 end
 ```
 
@@ -249,7 +314,7 @@ $ puma -b ssl://localhost:9292 -b tcp://localhost:9393 -C config/use_local_host.
 
 #### Controlling SSL Cipher Suites
 
-To use or avoid specific SSL cipher suites, use `ssl_cipher_filter` or `ssl_cipher_list` options.
+To use or avoid specific SSL ciphers for TLSv1.2 and below, use `ssl_cipher_filter` or `ssl_cipher_list` options.
 
 ##### Ruby:
 
@@ -263,6 +328,14 @@ $ puma -b 'ssl://127.0.0.1:9292?key=path_to_key&cert=path_to_cert&ssl_cipher_fil
 $ puma -b 'ssl://127.0.0.1:9292?keystore=path_to_keystore&keystore-pass=keystore_password&ssl_cipher_list=TLS_RSA_WITH_AES_128_CBC_SHA,TLS_RSA_WITH_AES_256_CBC_SHA'
 ```
 
+To configure the available TLSv1.3 ciphersuites, use `ssl_ciphersuites` option (not available for JRuby).
+
+##### Ruby:
+
+```
+$ puma -b 'ssl://127.0.0.1:9292?key=path_to_key&cert=path_to_cert&ssl_ciphersuites=TLS_AES_256_GCM_SHA384:TLS_AES_128_GCM_SHA256'
+```
+
 See https://www.openssl.org/docs/man1.1.1/man1/ciphers.html for cipher filter format and full list of cipher suites.
 
 Disable TLS v1 with the `no_tlsv1` option:
@@ -279,7 +352,7 @@ To enable verification flags offered by OpenSSL, use `verification_flags` (not a
 $ puma -b 'ssl://127.0.0.1:9292?key=path_to_key&cert=path_to_cert&verification_flags=PARTIAL_CHAIN'
 ```
 
-You can also set multiple verification flags (by separating them with coma):
+You can also set multiple verification flags (by separating them with a comma):
 
 ```
 $ puma -b 'ssl://127.0.0.1:9292?key=path_to_key&cert=path_to_cert&verification_flags=PARTIAL_CHAIN,CRL_CHECK'
@@ -320,7 +393,7 @@ Puma has a built-in status and control app that can be used to query and control
 $ puma --control-url tcp://127.0.0.1:9293 --control-token foo
 ```
 
-Puma will start the control server on localhost port 9293. All requests to the control server will need to include control token (in this case, `token=foo`) as a query parameter. This allows for simple authentication. Check out `Puma::App::Status` or [status.rb](https://github.com/puma/puma/blob/master/lib/puma/app/status.rb) to see what the status app has available.
+Puma will start the control server on localhost port 9293. All requests to the control server will need to include control token (in this case, `token=foo`) as a query parameter. This allows for simple authentication. Check out `Puma::App::Status` or [status.rb](https://github.com/puma/puma/blob/main/lib/puma/app/status.rb) to see what the status app has available.
 
 You can also interact with the control server via `pumactl`. This command will restart Puma:
 
@@ -352,7 +425,7 @@ $ puma -C "-"
 
 The other side-effects of setting the environment are whether to show stack traces (in `development` or `test`), and setting RACK_ENV may potentially affect middleware looking for this value to change their behavior. The default puma RACK_ENV value is `development`. You can see all config default values in `Puma::Configuration#puma_default_options` or [configuration.rb](https://github.com/puma/puma/blob/61c6213fbab/lib/puma/configuration.rb#L182-L204).
 
-Check out `Puma::DSL` or [dsl.rb](https://github.com/puma/puma/blob/master/lib/puma/dsl.rb) to see all available options.
+Check out `Puma::DSL` or [dsl.rb](https://github.com/puma/puma/blob/main/lib/puma/dsl.rb) to see all available options.
 
 ## Restart
 
@@ -372,19 +445,6 @@ Some platforms do not support all Puma features.
   * **Windows**: Cluster mode is not supported due to a lack of fork(2).
   * **Kubernetes**: The way Kubernetes handles pod shutdowns interacts poorly with server processes implementing graceful shutdown, like Puma. See the [kubernetes section of the documentation](docs/kubernetes.md) for more details.
 
-## Known Bugs
-
-For MRI versions 2.2.7, 2.2.8, 2.2.9, 2.2.10, 2.3.4 and 2.4.1, you may see ```stream closed in another thread (IOError)```. It may be caused by a [Ruby bug](https://bugs.ruby-lang.org/issues/13632). It can be fixed with the gem https://rubygems.org/gems/stopgap_13632:
-
-```ruby
-if %w(2.2.7 2.2.8 2.2.9 2.2.10 2.3.4 2.4.1).include? RUBY_VERSION
-  begin
-    require 'stopgap_13632'
-  rescue LoadError
-  end
-end
-```
-
 ## Deployment
 
  * Puma has support for Capistrano with an [external gem](https://github.com/seuros/capistrano-puma).

data/docs/deployment.md

@@ -16,32 +16,34 @@ assume this is how you're using Puma.
 Initially, Puma was conceived as a thread-only web server, but support for
 processes was added in version 2.
 
+In general, use single mode only if:
+
+* You are using JRuby, TruffleRuby or another fully-multithreaded implementation of Ruby
+* You are using MRI but in an environment where only 1 CPU core is available.
+
+Otherwise, you'll want to use cluster mode to utilize all available CPU resources.
+
 To run `puma` in single mode (i.e., as a development environment), set the
 number of workers to 0; anything higher will run in cluster mode.
 
-Here are some tips for cluster mode:
+## Cluster Mode Tips
 
-### MRI
+For the purposes of Puma provisioning, "CPU cores" means:
 
-* Use cluster mode and set the number of workers to 1.5x the number of CPU cores
-  in the machine, starting from a minimum of 2.
-* Set the number of threads to desired concurrent requests/number of workers.
-  Puma defaults to 5, and that's a decent number.
+1. On ARM, the number of physical cores.
+2. On x86, the number of logical cores, hyperthreads, or vCPUs (these words all mean the same thing).
 
-#### Migrating from Unicorn
+Set your config with the following process:
 
-* If you're migrating from unicorn though, here are some settings to start with:
-  * Set workers to half the number of unicorn workers you're using
-  * Set threads to 2
-  * Enjoy 50% memory savings
-* As you grow more confident in the thread-safety of your app, you can tune the
-  workers down and the threads up.
+* Use cluster mode and set `workers :auto` (requires the `concurrent-ruby` gem) to match the number of CPU cores on the machine (minimum 2, otherwise use single mode!). If you can't add the gem, set the worker count manually to the available CPU cores.
+* Set the number of threads to desired concurrent requests/number of workers.
+  Puma defaults to 5, and that's a decent number.
 
-#### Ubuntu / Systemd (Systemctl) Installation
+For most deployments, adding `concurrent-ruby` and using `workers :auto` is the right starting point.
 
-See [systemd.md](systemd.md)
+See [`workers :auto` gotchas](../lib/puma/dsl.rb).
 
-#### Worker utilization
+## Worker utilization
 
 **How do you know if you've got enough (or too many workers)?**
 
@@ -50,14 +52,34 @@ a time. But since so many apps are waiting on IO from DBs, etc., they can
 utilize threads to use the process more efficiently.
 
 Generally, you never want processes that are pegged all the time. That can mean
-there is more work to do than the process can get through. On the other hand, if
-you have processes that sit around doing nothing, then they're just eating up
-resources.
+there is more work to do than the process can get through, and requests will end up with additional latency. On the other hand, if
+you have processes that sit around doing nothing, then you're wasting resources and money.
+
+In general, you are making a tradeoff between:
+
+1. CPU and memory utilization.
+2. Time spent queueing for a Puma worker to `accept` requests and additional latency caused by CPU contention.
+
+If latency is important to you, you will have to accept lower utilization, and vice versa.
 
-Watch your CPU utilization over time and aim for about 70% on average. 70%
-utilization means you've got capacity still but aren't starving threads.
+## Container/VPS sizing
 
-**Measuring utilization**
+You will have to make a decision about how "big" to make each pod/VPS/server/dyno.
+
+**TL:DR;**: 80% of Puma apps will end up deploying "pods" of 4 workers, 5 threads each, 4 vCPU and 8GB of RAM.
+
+For the rest of this discussion, we'll adopt the Kubernetes term of "pods".
+
+Should you run 2 pods with 50 workers each? 25 pods, each with 4 workers? 100 pods, with each Puma running in single mode? Each scenario represents the same total amount of capacity (100 Puma processes that can respond to requests), but there are tradeoffs to make:
+
+* **Increasing worker counts decreases latency, but means you scale in bigger "chunks"**. Worker counts should be somewhere between 4 and 32 in most cases. You want more than 4 in order to minimize time spent in request queueing for a free Puma worker, but probably less than ~32 because otherwise autoscaling is working in too large of an increment or they probably won't fit very well into your nodes. In any queueing system, queue time is proportional to 1/n, where n is the number of things pulling from the queue. Each pod will have its own request queue (i.e., the socket backlog). If you have 4 pods with 1 worker each (4 request queues), wait times are, proportionally, about 4 times higher than if you had 1 pod with 4 workers (1 request queue).
+* **Increasing thread counts will increase throughput, but also latency and memory use** Unless you have a very I/O-heavy application (50%+ time spent waiting on IO), use the default thread count (5 for MRI). Using higher numbers of threads with low I/O wait (<50% of wall clock time) will lead to additional request latency and additional memory usage.
+* **Increasing worker counts decreases memory per worker on average**. More processes per pod reduces memory usage per process, because of copy-on-write memory and because the cost of the single master process is "amortized" over more child processes.
+* **Low worker counts (<4) have exceptionally poor throughput**. Don't run less than 4 processes per pod if you can. Low numbers of processes per pod will lead to high request queueing (see discussion above), which means you will have to run more pods and resources.
+* **CPU-core-to-worker ratios should be around 1**. If running Puma with `threads > 1`, allocate 1 CPU core (see definition above!) per worker. If single threaded, allocate ~0.75 cpus per worker. Most web applications spend about 25% of their time in I/O - but when you're running multi-threaded, your Puma process will have higher CPU usage and should be able to fully saturate a CPU core. Using `workers :auto` will size workers to this guidance on most platforms.
+* **Don't set memory limits unless necessary**. Most Puma processes will use about ~512MB-1GB per worker, and about 1GB for the master process. However, you probably shouldn't bother with setting memory limits lower than around 2GB per process, because most places you are deploying will have 2GB of RAM per CPU. A sensible memory limit for a Puma configuration of 4 child workers might be something like 8 GB (1 GB for the master, 7GB for the 4 children).
+
+**Measuring utilization and queue time**
 
 Using a timestamp header from an upstream proxy server (e.g., `nginx` or
 `haproxy`) makes it possible to indicate how long requests have been waiting for
@@ -75,7 +97,7 @@ a Puma thread to become available.
     * `env['puma.request_body_wait']` contains the number of milliseconds Puma
       spent waiting for the client to send the request body.
     * haproxy: `%Th` (TLS handshake time) and `%Ti` (idle time before request)
-      can can also be added as headers.
+      can also be added as headers.
 
 ## Should I daemonize?
 
@@ -100,3 +122,16 @@ or hell, even `monit`.
 You probably will want to deploy some new code at some point, and you'd like
 Puma to start running that new code. There are a few options for restarting
 Puma, described separately in our [restart documentation](restart.md).
+
+## Migrating from Unicorn
+
+* If you're migrating from unicorn though, here are some settings to start with:
+  * Set workers to half the number of unicorn workers you're using
+  * Set threads to 2
+  * Enjoy 50% memory savings
+* As you grow more confident in the thread-safety of your app, you can tune the
+  workers down and the threads up.
+
+## Ubuntu / Systemd (Systemctl) Installation
+
+See [systemd.md](systemd.md)

data/docs/fork_worker.md

@@ -22,10 +22,20 @@ The `fork_worker` option allows your application to be initialized only once for
 
    You can trigger a refork by sending the cluster the `SIGURG` signal or running the `pumactl refork` command at any time. A refork will also automatically trigger once, after a certain number of requests have been processed by worker 0 (default 1000). To configure the number of requests before the auto-refork, pass a positive integer argument to `fork_worker` (e.g., `fork_worker 1000`), or `0` to disable.
 
+### Usage Considerations
+
+- `fork_worker` introduces new `before_refork` and `after_refork` configuration hooks. Note the following:
+    - When initially forking the parent process to the worker 0 child, `before_fork` will trigger on the parent process and `before_worker_boot` will trigger on the worker 0 child as normal.
+    - When forking the worker 0 child to grandchild workers, `before_refork` and `after_refork` will trigger on the worker 0 child, and `before_worker_boot` will trigger on each grandchild worker.
+    - For clarity, `before_fork` does not trigger on worker 0, and `after_refork` does not trigger on the grandchild.
+- As a general migration guide:
+    - Copy any logic within your existing `before_fork` hook to the `before_refork` hook.
+    - Consider to copy logic from your `before_worker_boot` hook to the `after_refork` hook, if it is needed to reset the state of worker 0 after it forks.
+
 ### Limitations
 
 - This mode is still very experimental so there may be bugs or edge-cases, particularly around expected behavior of existing hooks. Please open a [bug report](https://github.com/puma/puma/issues/new?template=bug_report.md) if you encounter any issues.
 
 - In order to fork new workers cleanly, worker 0 shuts down its server and stops serving requests so there are no open file descriptors or other kinds of shared global state between processes, and to maximize copy-on-write efficiency across the newly-forked workers. This may temporarily reduce total capacity of the cluster during a phased restart / refork.
 
-  In a cluster with `n` workers, a normal phased restart stops and restarts workers one by one while the application is loaded in each process, so `n-1` workers are available serving requests during the restart. In a phased restart in fork-worker mode, the application is first loaded in worker 0 while `n-1` workers are available, then worker 0 remains stopped while the rest of the workers are reloaded one by one, leaving only `n-2` workers to be available for a brief period of time. Reloading the rest of the workers should be quick because the application is preloaded at that point, but there may be situations where it can take longer (slow clients, long-running application code, slow worker-fork hooks, etc).
+- In a cluster with `n` workers, a normal phased restart stops and restarts workers one by one while the application is loaded in each process, so `n-1` workers are available serving requests during the restart. In a phased restart in fork-worker mode, the application is first loaded in worker 0 while `n-1` workers are available, then worker 0 remains stopped while the rest of the workers are reloaded one by one, leaving only `n-2` workers to be available for a brief period of time. Reloading the rest of the workers should be quick because the application is preloaded at that point, but there may be situations where it can take longer (slow clients, long-running application code, slow worker-fork hooks, etc).

data/docs/java_options.md

@@ -0,0 +1,54 @@
+# Java Options
+
+`System Properties` or `Environment Variables` can be used to change Puma's
+default configuration for its Java extension. The provided values are evaluated
+during initialization, and changes while running the app have no effect.
+Moreover, default values may be used in case of invalid inputs.
+
+## Supported Options
+
+| ENV Name                     | Default Value |        Validation        |
+|------------------------------|:-------------:|:------------------------:|
+| PUMA_QUERY_STRING_MAX_LENGTH |   1024 * 10   | Positive natural number  |
+| PUMA_REQUEST_PATH_MAX_LENGTH |     8192      | Positive natural number  |
+| PUMA_REQUEST_URI_MAX_LENGTH  |   1024 * 12   | Positive natural number  |
+| PUMA_SKIP_SIGUSR2            |   nil         | n/a                      |
+
+## Examples
+
+### Invalid inputs
+
+An empty string will be handled as missing, and the default value will be used instead.
+Puma will print an error message for other invalid values.
+
+```
+foo@bar:~/puma$ PUMA_QUERY_STRING_MAX_LENGTH=abc PUMA_REQUEST_PATH_MAX_LENGTH='' PUMA_REQUEST_URI_MAX_LENGTH=0 bundle exec bin/puma test/rackup/hello.ru
+
+The value 0 for PUMA_REQUEST_URI_MAX_LENGTH is invalid. Using default value 12288 instead.
+The value abc for PUMA_QUERY_STRING_MAX_LENGTH is invalid. Using default value 10240 instead.
+Puma starting in single mode...
+```
+
+### Valid inputs
+
+```
+foo@bar:~/puma$ PUMA_REQUEST_PATH_MAX_LENGTH=9 bundle exec bin/puma test/rackup/hello.ru
+
+Puma starting in single mode...
+```
+```
+foo@bar:~ export path=/123456789 # 10 chars
+foo@bar:~ curl "http://localhost:9292${path}"
+
+Puma caught this error: HTTP element REQUEST_PATH is longer than the 9 allowed length. (Puma::HttpParserError)
+
+foo@bar:~ export path=/12345678 # 9 chars
+foo@bar:~ curl "http://localhost:9292${path}"
+Hello World
+```
+
+### Java Flight Recorder Compatibility
+
+Unfortunately Java Flight Recorder uses `SIGUSR2` internally. If you wish to 
+use JFR, turn off Puma's trapping of `SIGUSR2` by setting the environment variable
+`PUMA_SKIP_SIGUSR2` to any value.

data/docs/jungle/README.md

@@ -2,7 +2,7 @@
 
 ## Systemd
 
-See [/docs/systemd](https://github.com/puma/puma/blob/master/docs/systemd.md).
+See [/docs/systemd](https://github.com/puma/puma/blob/main/docs/systemd.md).
 
 ## rc.d
 

data/docs/kubernetes.md

@@ -2,16 +2,17 @@
 
 ## Running Puma in Kubernetes
 
-In general running Puma in Kubernetes works as-is, no special configuration is needed beyond what you would write anyway to get a new Kubernetes Deployment going. There is one known interaction between the way Kubernetes handles pod termination and how Puma handles `SIGINT`, where some request might be sent to Puma after it has already entered graceful shutdown mode and is no longer accepting requests. This can lead to dropped requests during rolling deploys. A workaround for this is listed at the end of this article.
+In general running Puma in Kubernetes works as-is, no special configuration is needed beyond what you would write anyway to get a new Kubernetes Deployment going. There is one known interaction between the way Kubernetes handles pod termination and how Puma handles `SIGINT`, where some requests might be sent to Puma after it has already entered graceful shutdown mode and is no longer accepting requests. This can lead to dropped requests during rolling deploys. A workaround for this is listed at the end of this article.
 
 ## Basic setup
 
 Assuming you already have a running cluster and docker image repository, you can run a simple Puma app with the following example Dockerfile and Deployment specification. These are meant as examples only and are deliberately very minimal to the point of skipping many options that are recommended for running in production, like healthchecks and envvar configuration with ConfigMaps. In general you should check the [Kubernetes documentation](https://kubernetes.io/docs/home/) and [Docker documentation](https://docs.docker.com/) for a more comprehensive overview of the available options.
 
-A basic Dockerfile example: 
-```
-FROM ruby:2.5.1-alpine # can be updated to newer ruby versions
-RUN apk update && apk add build-base # and any other packages you need 
+A basic Dockerfile example:
+
+```Dockerfile
+FROM ruby:3.4.5-alpine # can be updated to newer ruby versions
+RUN apk update && apk add build-base # and any other packages you need
 
 # Only rebuild gem bundle if Gemfile changes
 COPY Gemfile Gemfile.lock ./
@@ -26,7 +27,8 @@ CMD bundle exec rackup -o 0.0.0.0
 ```
 
 A sample `deployment.yaml`:
-```
+
+```yaml
 ---
 apiVersion: apps/v1
 kind: Deployment
@@ -47,7 +49,7 @@ spec:
         image: <your image here>
         ports:
         - containerPort: 9292
-``` 
+```
 
 ## Graceful shutdown and pod termination
 
@@ -59,7 +61,7 @@ For some high-throughput systems, it is possible that some HTTP requests will re
 4. The pod has up to `terminationGracePeriodSeconds` (default: 30 seconds) to gracefully shut down. Puma will do this (after it receives SIGTERM) by closing down the socket that accepts new requests and finishing any requests already running before exiting the Puma process.
 5. If the pod is still running after `terminationGracePeriodSeconds` has elapsed, the pod receives `SIGKILL` to make sure the process inside it stops. After that, the container exits and all other Kubernetes objects associated with it are cleaned up.
 
-There is a subtle race condition between step 2 and 3: The replication controller does not synchronously remove the pod from the Services AND THEN call the pre-stop hook of the pod, but rather it asynchronously sends "remove this pod from your endpoints" requests to the Services and then immediately proceeds to invoke the pods' pre-stop hook. If the Service controller (typically something like nginx or haproxy) receives this request handles this request "too" late (due to internal lag or network latency between the replication and Service controllers) then it is possible that the Service controller will send one or more requests to a Puma process which has already shut down its listening socket. These requests will then fail with 5XX error codes.
+There is a subtle race condition between step 2 and 3: The replication controller does not synchronously remove the pod from the Services AND THEN call the pre-stop hook of the pod, but rather it asynchronously sends "remove this pod from your endpoints" requests to the Services and then immediately proceeds to invoke the pods' pre-stop hook. If the Service controller (typically something like nginx or haproxy) receives and handles this request "too" late (due to internal lag or network latency between the replication and Service controllers) then it is possible that the Service controller will send one or more requests to a Puma process which has already shut down its listening socket. These requests will then fail with 5XX error codes.
 
 The way Kubernetes works this way, rather than handling step 2 synchronously, is due to the CAP theorem: in a distributed system there is no way to guarantee that any message will arrive promptly. In particular, waiting for all Service controllers to report back might get stuck for an indefinite time if one of them has already been terminated or if there has been a net split. A way to work around this is to add a sleep to the pre-stop hook of the same time as the `terminationGracePeriodSeconds` time. This will allow the Puma process to keep serving new requests during the entire grace period, although it will no longer receive new requests after all Service controllers have propagated the removal of the pod from their endpoint lists. Then, after `terminationGracePeriodSeconds`, the pod receives `SIGKILL` and closes down. If your process can't handle SIGKILL properly, for example because it needs to release locks in different services, you can also sleep for a shorter period (and/or increase `terminationGracePeriodSeconds`) as long as the time slept is longer than the time that your Service controllers take to propagate the pod removal. The downside of this workaround is that all pods will take at minimum the amount of time slept to shut down and this will increase the time required for your rolling deploy.
 
@@ -67,12 +69,5 @@ More discussions and links to relevant articles can be found in https://github.c
 
 ## Workers Per Pod, and Other Config Issues
 
-With containerization, you will have to make a decision about how "big" to make each pod. Should you run 2 pods with 50 workers each? 25 pods, each with 4 workers? 100 pods, with each Puma running in single mode? Each scenario represents the same total amount of capacity (100 Puma processes that can respond to requests), but there are tradeoffs to make.
-
-* Worker counts should be somewhere between 4 and 32 in most cases. You want more than 4 in order to minimize time spent in request queueing for a free Puma worker, but probably less than ~32 because otherwise autoscaling is working in too large of an increment or they probably won't fit very well into your nodes. In any queueing system, queue time is proportional to 1/n, where n is the number of things pulling from the queue. Each pod will have its own request queue (i.e., the socket backlog). If you have 4 pods with 1 worker each (4 request queues), wait times are, proportionally, about 4 times higher than if you had 1 pod with 4 workers (1 request queue).
-* Unless you have a very I/O-heavy application (50%+ time spent waiting on IO), use the default thread count (5 for MRI). Using higher numbers of threads with low I/O wait (<50%) will lead to additional request queueing time (latency!) and additional memory usage.
-* More processes per pod reduces memory usage per process, because of copy-on-write memory and because the cost of the single master process is "amortized" over more child processes.
-* Don't run less than 4 processes per pod if you can. Low numbers of processes per pod will lead to high request queueing, which means you will have to run more pods.
-* If multithreaded, allocate 1 CPU per worker. If single threaded, allocate 0.75 cpus per worker. Most web applications spend about 25% of their time in I/O - but when you're running multi-threaded, your Puma process will have higher CPU usage and should be able to fully saturate a CPU core.
-* Most Puma processes will use about ~512MB-1GB per worker, and about 1GB for the master process. However, you probably shouldn't bother with setting memory limits lower than around 2GB per process, because most places you are deploying will have 2GB of RAM per CPU. A sensible memory limit for a Puma configuration of 4 child workers might be something like 8 GB (1 GB for the master, 7GB for the 4 children).
+See our [deployment docs](./deployment.md) for more information about how to correctly size your pods and choose the right number of workers and threads.
 

data/docs/plugins.md

@@ -5,13 +5,13 @@ operations.
 
 There are two canonical plugins to aid in the development of new plugins:
 
-* [tmp\_restart](https://github.com/puma/puma/blob/master/lib/puma/plugin/tmp_restart.rb):
+* [tmp\_restart](https://github.com/puma/puma/blob/main/lib/puma/plugin/tmp_restart.rb):
   Restarts the server if the file `tmp/restart.txt` is touched
 * [heroku](https://github.com/puma/puma-heroku/blob/master/lib/puma/plugin/heroku.rb):
   Packages up the default configuration used by Puma on Heroku (being sunset
   with the release of Puma 5.0)
 
-Plugins are activated in a Puma configuration file (such as `config/puma.rb'`)
+Plugins are activated in a Puma configuration file (such as `config/puma.rb`)
 by adding `plugin "name"`, such as `plugin "heroku"`.
 
 Plugins are activated based on path requirements so, activating the `heroku`
@@ -36,3 +36,7 @@ object that is useful for additional configuration.
 
 Public methods in [`Puma::Plugin`](../lib/puma/plugin.rb) are treated as a
 public API for plugins.
+
+## Binder hooks
+
+There's `Puma::Binder#before_parse` method that allows to add proc to run before the body of `Puma::Binder#parse`. Example of usage can be found in [that repository](https://github.com/anchordotdev/puma-acme/blob/v0.1.3/lib/puma/acme/plugin.rb#L97-L118) (`before_parse_hook` could be renamed `before_parse`, making monkey patching of [binder.rb](https://github.com/anchordotdev/puma-acme/blob/v0.1.3/lib/puma/acme/binder.rb) is unnecessary).

data/docs/restart.md

@@ -29,7 +29,7 @@ Any of the following will cause a Puma server to perform a hot restart:
 
 * The newly started Puma process changes its current working directory to the directory specified by the `directory` option. If `directory` is set to symlink, this is automatically re-evaluated, so this mechanism can be used to upgrade the application.
 * Only one version of the application is running at a time.
-* `on_restart` is invoked just before the server shuts down. This can be used to clean up resources (like long-lived database connections) gracefully. Since Ruby 2.0, it is not typically necessary to explicitly close file descriptors on restart. This is because any file descriptor opened by Ruby will have the `FD_CLOEXEC` flag set, meaning that file descriptors are closed on `exec`. `on_restart` is useful, though, if your application needs to perform any more graceful protocol-specific shutdown procedures before closing connections.
+* `before_restart` is invoked just before the server shuts down. This can be used to clean up resources (like long-lived database connections) gracefully. Since Ruby 2.0, it is not typically necessary to explicitly close file descriptors on restart. This is because any file descriptor opened by Ruby will have the `FD_CLOEXEC` flag set, meaning that file descriptors are closed on `exec`. `before_restart` is useful, though, if your application needs to perform any more graceful protocol-specific shutdown procedures before closing connections.
 
 ## Phased restart
 
@@ -59,7 +59,7 @@ Any of the following will cause a Puma server to perform a phased restart:
 
 * When a phased restart begins, the Puma master process changes its current working directory to the directory specified by the `directory` option. If `directory` is set to symlink, this is automatically re-evaluated, so this mechanism can be used to upgrade the application.
 * On a single server, it's possible that two versions of the application are running concurrently during a phased restart.
-* `on_restart` is not invoked
+* `before_restart` is not invoked
 * Phased restarts can be slow for Puma clusters with many workers. Hot restarts often complete more quickly, but at the cost of increased latency during the restart.
 * Phased restarts cannot be used to upgrade any gems loaded by the Puma master process, including `puma` itself, anything in `extra_runtime_dependencies`, or dependencies thereof. Upgrading other gems is safe.
 * If you remove the gems from old releases as part of your deployment strategy, there are additional considerations. Do not put any gems into `extra_runtime_dependencies` that have native extensions or have dependencies that have native extensions (one common example is `puma_worker_killer` and its dependency on `ffi`). Workers will fail on boot during a phased restart. The underlying issue is recorded in [an issue on the rubygems project](https://github.com/rubygems/rubygems/issues/4004). Hot restarts are your only option here if you need these dependencies.