Phusion Passenger 5 beta 2
The first Passenger 5 beta was released about 3 weeks ago. This major new version brought many changes, such as performance improvements, better tools for application-level visibility and a new HTTP JSON API for accessing Passenger’s internals.
Beta 1 was not considered production ready. In the past 3 weeks we’ve been working hard to fix bugs. The result is beta 2, which fixes 8 issues.
- Fixed handling of multiple Set-Cookie headers. Closes GH-1296.
passenger-config system-metrics
now works properly if the agent is installed in ~/.passenger. Closes GH-1304.- Documentation enhancements by Igor Vuk. Closes GH-1318.
- Fixed some crasher bugs.
- [Standalone] User switching is now correctly disabled.
- [Standalone] Fixed the
--thread-count
parameter. - [Apache] IPs set by mod_remoteip are now respected. Closes GH-1284.
- [Apache] Fixed support for gzipped chunked responses. Closes GH-1309.
Installing or upgrading
Here’s a quickstart:
gem install passenger --pre -v 5.0.0.beta2
cd /path-to-your-app
passenger start
The above is a very short excerpt of how to install or upgrade Phusion Passenger. For detailed instructions (which, for example, take users and permissions into account), please refer to the “RubyGems” section of the installation manuals:
Please note:
- 5.0.0 beta 2 is a beta release. There are still major bugs open and we do not recommend using it in production yet.
- There are no Homebrew or Debian packages for this release, because this release is still in beta!
- There is also a 5.0.0 beta 2 release of Phusion Passenger Enterprise available. Please refer to the Customer Area.
Phusion Passenger 4.0.56: facepalming at file descriptor leak, Node.js load balancing
We’ve just released version 4.0.56 of the Phusion Passenger application server for Ruby, Python and Node.js, which fixes a number of interesting and important bugs. They’re the kind of typical bugs that make me go “what the **** was I thinking?!” after I’ve analyzed them, because the fixes are very simple.
Leaking file descriptors
The first bug is a file descriptor leak. A file descriptor is number which represents a kernel resource, such as an open file or a socket. Every time you call File.open
or TCPSocket.new
in Ruby, you get an IO object that’s internally backed by a file descriptor. In Node.js you even often work with file descriptors directly: most fs
functions return a file descriptor. Since Phusion Passenger is written in C++, we also work with file descriptors directly.
Schematically, it looks like this:
You’re probably familiar with memory leaks. A file descriptor leak is very similar. If you ever lose track of a file descriptor number, you’ve leaked it. In Ruby this is not possible because all IO objects own their file descriptor, and IO objects are garbage collected (thus closing the corresponding file descriptor). However in Node.js and in C++ this can easily happen if you’re not careful. When leaked, the kernel resource stays allocated until your process exits.
What went wrong
In Passenger, we leaked a file descriptor when creating an error report file. This file is created if your app can’t spawn for some reason (e.g. it throws an exception during startup). The code that was responsible for rendering the file looked like this, in semi C++ pseudocode:
void processAndLogNewSpawnException(SpawnException &e) {
int fd = -1;
FdGuard guard(fd);
fd = createNewReportFile();
if (fd != -1) {
renderReportFileContents(fd, e);
}
}
Notice the guard
variable. In C++, it is a so-called RAII object: “Resource Acquisition Is Initialization”. It is a common coding pattern in C++ to ensure that things are cleaned up when exceptions are thrown, kind of like the C++ equivalent of the ensure
keyword in Ruby or the finally
keyword in Javascript. When this function exits for any reason, be it a normal return or an exception, the guard
destructor is called, which is supposed to close the file descriptor.
The facepalm moment was when Paul “popox” B reported that the guard was on the wrong line. The guard was created before the file descriptor was assigned to fd
, so the guard did nothing all this time. Every time a report file was created, a file descriptor was leaked.
The one-line fix
The solution was to move the guard object a little bit:
void processAndLogNewSpawnException(SpawnException &e) {
int fd = -1;
// Guard object was here
fd = createNewReportFile();
// It is now here
FdGuard guard(fd);
if (fd != -1) {
renderReportFileContents(fd, e);
}
}
Thank you Paul B!
Node.js load balancing
The other issue fixed in 4.0.56 is a Node.js load balancing issue. In Passenger we load balance requests between application processes as much as possible. Traditionally, the reason for load balancing has been to minimize latency. This utilizes the concept of “application concurrency”: the maximum number of concurrent requests a single app process can handle. For Ruby apps, the concurrency is 1 (unless you configured multithreading, in which case the concurrency is equal to the number of threads). Since Ruby apps have finite I/O concurrency, Passenger load balances a request to a different process only if one process has run out of concurrency.
Node.js is different in that it’s fully asynchronous. It can effectively have an unlimited amount of concurrency.
Passenger orders processes in a priority queue by “busyness”. Load balancing is achieved by routing a new request to the process with the least busyness.
What went wrong
What went wrong with the Node.js case is the fact that we had special rules for application processes with unlimited concurrency. The busyness for such processes is calculated as follows:
if (sessions == 0) {
return 0;
} else {
return 1;
}
sessions
indicates the number of requests that a process is currently handling. This piece of code effectively sorted Node.js processes in two categories only: idle processes and non-idle processes.
From a concurrency point of view, there is nothing wrong with this. Node.js apps have unlimited concurrency after all. However this resulted in lots of requests “sticking” to a few processes, as Charles Vallières reported:
* PID: 24526 Sessions: 84 Processed: 1 Uptime: 9s
* PID: 24545 Sessions: 1 Processed: 0 Uptime: 9s
* PID: 24571 Sessions: 83 Processed: 0 Uptime: 8s
* PID: 24596 Sessions: 1 Processed: 0 Uptime: 8s
Then it dawned to me that I forgot something. An even distribution of requests is desirable here, because now the reason for load balancing becomes different. It’s to maximize CPU core usage, because single Node.js process can only use 1 CPU core.
The fix
The fix was incredibly easy:
return sessions;
Yes, facepalm time.
Thank you Charles Vallières!
Installing or upgrading to 4.0.56
![]() |
![]() |
![]() |
![]() |
![]() |
![]() |
Final
Phusion Passenger’s core is open source. PleaseIf you would like to stay up to date with Phusion news, please fill in your name and email address below and sign up for our newsletter. We won’t spam you, we promise.
Phusion Passenger 4.0.55 released, supports Ruby 2.2
Phusion Passenger is a fast and robust web server and application server for Ruby, Python, Node.js and Meteor. Passenger takes a lot of complexity out of deploying web apps, and adds powerful enterprise-grade features that are useful in production. High-profile companies such as Apple, New York Times, AirBnB, Juniper, American Express, etc are already using it, as well as over 350.000 websites.
Phusion Passenger is under constant maintenance and development. Version 4.0.55 is a bugfix release.
Phusion Passenger also has an Enterprise version which comes with a wide array of additional features. By buying Phusion Passenger Enterprise you will directly sponsor the development of the open source version.
Recent changes
Version 4.0.54 has been skipped because it was a hotfix for Enterprise customers. The changes in 4.0.54 and 4.0.55 combined are as follows:
- Supports Ruby 2.2. Ruby 2.2 isn’t released yet and only exists as an alpha, but we’re supporting it anyway. Closes GH-1314.
- Fixed Linux OS name detection.
- Contains a licensing-related hot fix for Enterprise customers.
Installing or upgrading to 4.0.55
![]() |
![]() |
![]() |
![]() |
![]() |
![]() |
Final
Phusion Passenger’s core is open source. PleaseIf you would like to stay up to date with Phusion news, please fill in your name and email address below and sign up for our newsletter. We won’t spam you, we promise.
Introducing Traveling Ruby
Ruby is one of our favorite programming languages. Most people use it for web development, but Ruby is so much more. We at Phusion have been using Ruby for years for writing sysadmin automation scripts, developer command line tools and more. Heroku’s Toolbelt and Chef have also demonstrated that Ruby is an excellent language for these sorts of things.
However, distributing Ruby apps to non-Ruby-programmer end users on Linux and OS X is problematic. If you require users to install Ruby or to use RubyGems, they can get into trouble or become frustrated.
Creating platform-specific packages for each Linux distro and each OS requires a lot of work. Because building such packages requires a fleet of VMs, building packages takes a lot of time.
Our solution to this problem is Traveling Ruby, which lets you create self-contained Ruby app packages for Linux and OS X. It is a project which supplies self-contained, “portable” Ruby binaries: Ruby binaries that can run on any Linux distribution and any OS X machine. This allows Ruby app developers to bundle these binaries with their Ruby app, so that they can distribute a single package to end users, without needing end users to first install Ruby or gems.
Learn more about the motivation behind Traveling Ruby.
Key benefits
- Self-contained: apps packaged with Traveling Ruby are completely self-contained and don’t require the user to install any further dependencies or runtimes.
- Simple & easy: Traveling Ruby is very simple to use and very easy to learn. No complicated tooling to learn. You can grasp the basics in just 5 minutes.
- Fast & lightweight: produce packages for multiple OS targets, regardless of which OS you are developing on. This is achieved without the need for heavyweight tools like VMs.
Learn more
You can learn more about Traveling Ruby here:
Introducing Phusion Passenger 5 beta 1, codename “Raptor”
Executive summary
Phusion Passenger is an app server that supports Ruby. We have released version 5 beta 1, codename “Raptor”. This new version is much faster, helps you better identify and solve problems, and has a ton of other improvements. If you’ve followed the Raptor campaign then you may wonder why we held the campaign like this. Read on if you’re interested. If you just want to try it, scroll all the way down for the changelog and the installation and upgrade instructions.
Learn more about Phusion Passenger
Introduction
A month ago, we released a website in which we announced “Raptor”, supposedly a new Ruby app server that’s much faster than others. It has immediately received a lot of community attention. It was covered by Fabio Akita and by RubyInside’s Peter Cooper. From the beginning, “Raptor” was Phusion Passenger 5, a new major version with major internal overhauls. In the weeks that followed, we blogged about how we made “Raptor” fast.
Even though “Raptor” is Phusion Passenger, it doesn’t make the impact any less powerful. The performance improvements that we claim are real, and they are open source. Because “Raptor” is Phusion Passenger 5, it means that it automatically has a mature set of features:
- Handle more traffic
Phusion Passenger 5 is up to 4x faster than other Ruby app servers, allowing you to handle more traffic with the same hardware. - Reduce maintenance
Automates more system tasks than other app servers. Spend less time micromanaging software, and more time building your business. - Identify & fix problems quickly
Why is your app behaving the way it does? What is it doing? Phusion Passenger 5 provides tools that give you the insights you need. - Keep bugs & issues in check
Limit the impact of bugs and issues, making downtime and user dissatisfaction less likely. Reduce pressure on developers while the root problem is being fixed. - Excellent support
We have excellent documentation and a vibrant community discussion forum. And with our professional and enterprise support contracts, you can consult our team of experts directly. - Improve security
Provides extra layers of defense, reduces attack surfaces on applications and limits the impact of security vulnerabilities.
However, the authors behind “Raptor” remained unknown — until today. The reason why we ran the campaign like this is explained in this article.
A brief history
It is perhaps hard to fathom now, but in the early days of Ruby, getting an app into a production environment was a painful task in itself. Many hours were spent by developers on tedious tasks such as manually managing ports and performing other error-prone configuration sit-ups. The status quo of deployment back then wasn’t exactly in line with what Rails advocates through its “convention over configuration” mantra. Far from it in fact.
When we first introduced Phusion Passenger back in 2008, we wanted to “fix” this. We wanted Ruby deployment to be as easy as PHP so that developers could focus on their apps and lower the barrier of entry for newcomers.
Even though we have been able to help power some of the largest sites on the Internet over the past few years through Phusion Passenger, we have always remained vigilant as to not become complacent: we have been eagerly listening to the community as to what they expect the next big thing to be.
The observations we have made over the years have eventually culminated into Phusion Passenger 5, which was codenamed Raptor for a number of reasons.
A greater focus on performance and efficiency
Whether you are deploying a small web app on a VPS or spinning up tens of thousands of instances to power your e-commerce business, we all want the most bang for our buck. Being able to reduce the number of required servers would be beneficial in reducing costs and it is for this reason that developers seek to employ the most efficient software stack currently available. When it comes to making that choice, benchmarks from third parties often seem to play an important part in the decision making process. Even though they are convenient to consult, it is easy to overlook a couple of important things that we would like to underline.
When it comes to performance benchmarks for example, it does not always become clear how the results have been obtained and how they will affect the reader. This is mostly due to the fact that benchmarks are often performed on synthetic applications in synthetic environments that don’t take into consideration real world workloads and latencies. This often leads to skewed results when compared to real time workloads.
A good example of this is the “Hello World” benchmark, where people tend to benchmark app servers against a so-called “Hello World” application: an app that basically returns “Hello World”. Needless to say, this is hardly a real world application.
Anyone who has ever deployed a real world application will know that these kinds of benchmarks don’t really say anything useful as they effectively measure how fast an app server is at “doing nothing”.
In real world Ruby applications on the other hand, processing time quickly gets overtaken by the app itself, plus network overhead, rather than the app server: the differences in performance between the app servers basically become insignificant when compared to the time spent in the hosted app itself.
Despite this, benchmarks remain a popular source to consult when trying to figure out what the “best” software solution is. The danger here lies in the possibility that a developer might be tempted to base their decision solely on what bar chart sticks out the most, without so much as looking at what the other solutions all bring to the table.
There is a reason for example why Phusion Passenger — even though hot on the heels of its competitors — has not been leading these kinds of Hello World benchmarks in the past: we do much more than the competition does when it comes to ease of use, memory efficiency, security and features. All these things are not free, and this is basically what is being measured with said benchmarks.
When benchmarked against real world applications however, the differences in performance between app servers becomes almost indistinguishable. The focus should then be put on what feature-set is most suitable for your production app. We believe that on that front, Phusion Passenger is leading the pack.
We have tried many times to explain this in the comment sections of benchmarks, but have unfortunately had to infer that such explanations often fall on deaf ears. We think that’s a shame, but rather than continue to fight it, we have decided to try to beat our competitors on performance as well. This has led to a series of internal optimizations and innovations which we have documented in the Raptor articles. Not only do we believe we are now able to win these kinds of benchmarks, we believe we have been able to do so with mechanisms that are incredibly useful in real world scenarios too (e.g. Turbocaching).
A greater focus on showcasing the technology
Software that is easy to use runs the risk of being considered “boring” to hackers, or worse, “simple”. In the latter case, the underlying technology facilitating the ease of use gets taken granted for. Over the years, we felt this was happening to Phusion Passenger to the extent that we wanted to set the record straight.
A lot of thought went into using the right algorithms and applying the right optimizations to allow Phusion Passenger to do what it does best: being able to deliver an “upload-and-go” deployment experience second to none in a secure and performant manner is by no means a trivial task. We chose to abstract these implementation details however from the end-user as we wanted them to be able to focus more on their app and business rather than the nitty gritty when it came down to how “the soup was made”. Who cares right?
Well, as it turned out, a lot of hackers do. Articles about “Unicorn being Unix” sparked a lot of interest from hackers allowing it to quickly garner a following. We thought articles such as these were great, but felt somewhat disappointed that people seemed to forget that Phusion Passenger was already doing the majority of what was written in such articles a full year earlier. It then dawned on us that we were no longer being considered to be the new shiny thing, but rather considered being part of the establishment.
In hindsight, it was perhaps also an error of judgement of us to focus our marketing efforts mostly on businesses rather than the grassroots hacker community we originated from ourselves: they are not mutually exclusive and instead of mostly underlining the business advantages, we should have underlined the technological advantages much more as well.
In an effort to set this straight, we chose to document Raptor’s underlying technology in great detail which was incredibly well received by the Hacker News community. It was in fact on the front page for most of the day with close to 200 upvotes and sparked a lot of discussions on Twitter too.
Besides the new optimizations and features found in Raptor, a lot of technology discussed in those articles was already available in Phusion Passenger 4 and its precursors. If there is a lesson to take from all this, it is that marketing is indeed the art of repetition. And that it probably helps to present it as the new kid on the block to get rid of any preconceived notions/misconceptions people might have had about Phusion Passenger.
Smoke and mirrors
Whether or not people would be just as excited if they knew that it was Phusion Passenger 5 all along is perhaps another discussion to be had: some actually found out ahead of time due to the similar writing style of our tech articles and / or through nslookups (a fedora hat-tip goes out to you folks! May your sense of scrutiny live long and prosper!).
What we do however know is that our Raptor approach over the past month has produced more subscribers to our newsletter than we have been able to accomplish over the past 6 years through the Phusion Passenger moniker. We still have a hard time comprehending this, but there is no denying the numbers: we — the community — seem to like shiny new things.
Truth be told, we didn’t really bother trying to cover up the fact that it was in fact Phusion all along that was behind Raptor. We kind of left it as an exercise to the reader to figure this out amidst all the “hype” and claims of “vaporware” to see if people still remembered Phusion Passenger’s fortes.
We were not disappointed when it came to that and felt incredibly proud that a lot of people questioned why Phusion Passenger was not included within the Raptor benchmarks and requested it to be included. Needless to say, this was something we were unable to do because it already was included all along as Raptor itself 😉 We were also happy to see that some even pointed out that some of the features look like they came straight out of Phusion Passenger.
What’s in a name?
You might be wondering why we chose to market Phusion Passenger 5 under the Raptor code name and went through so many hoops in doing so. To quote Shakespeare: “Conceal me what I am, and be my aid, for a disguise as haply shall become, the form of my intent”.
With all the new improvements and features pertaining to performance and introspection, we felt Phusion Passenger deserved new consideration from its audience in an objective manner. To circumvent any preconceived notions and/or misconceptions people may have had about Phusion Passenger over the years, we decided to market it as Raptor. We felt the codename was particularly appropriate for our renewed commitment to performance.
Just to be clear, Phusion Passenger will not be renamed to Raptor. Raptor is just a codename that has served its purpose by the time of this writing for Phusion Passenger 5. We will drop this name starting from today: from now on, “Raptor” is Phusion Passenger 5.
With a little help from our friends
The success of the Raptor campaign would not have been possible without the help and support of our friends. In particular, we would like to thank Peter Cooper and Fabio Akita for their in-depth write-ups on Phusion Passenger 5 / Raptor and its precursors. Their articles carried the necessary weight to allow us to focus on explaining and improving the technology itself rather than having to spend time on trying to debunk “vaporware” claims. In a similar manner, we would also like to thank David Heinemeier Hansson for helping us out via his tweets and feedback.
Lastly, we would like to thank the community and our customers for being so supportive. At the end of the day, it is you folks who make this all possible and we can’t wait to show you what we have in store for the future.
Final words before upgrade instructions
Phusion Passenger’s core is open source.If you would like to stay up to date with Phusion news, please fill in your name and email address below and sign up for our newsletter. We won’t spam you, we promise.
Changelog
5.0.0 beta 1 is a beta release. It may still have bugs and we do not recommend using it in production yet.
Version 5.0.0 beta 1 contains major changes. It is mostly compatible with version 4, but there are a few minor breakages, which are described below. Major changes and notable breakages are:
- Performance has been much improved. This is thanks to months of optimization work. You can learn more at www.rubyraptor.org.
- We have published a server optimization guide for those who are interested in tuning Phusion Passenger.
- Support for Rails 1.2 – 2.2 has been removed, for performance reasons. Rails 2.3 is still supported.
- Phusion Passenger now supports integrated HTTP caching, which we call turbocaching. If your app sets the right HTTP headers then Phusion Passenger can tremendously accelerate your app. It is enabled by default, but you can disable it with
--disable-turbocaching
(Standalone),PassengerTurbocaching off
(Apache), orpassenger_turbocaching off
(Nginx). - Touching restart.txt will no longer restart your app immediately. This is because, for performance reasons, the stat throttle rate now defaults to 10. You can still get back the old behavior by setting
PassengerStatThrottleRate 0
(Apache) orpassenger_stat_throttle_rate 0
(Nginx), but this is not encouraged. Instead, we encourage you to use thepassenger-config restart-app
tool to initiate restarts, which has immediate effect. - Websockets are now properly disconnected on application restarts.
- The Phusion Passenger log levels have been completely revamped. If you were setting a log level before (e.g. through
passenger_log_level
), please read the latest documentation to learn about the new log levels. - If you use out-of-band garbage collection, beware that the
X-Passenger-Request-OOB-Work
header has now been renamed to!~Request-OOB-Work
. - When using Rack’s full socket hijacking, you must now output an HTTP status line.
- [Nginx] The
passenger_set_cgi_param
option has been removed and replaced bypassenger_set_header
andpassenger_env_var
. - [Nginx]
passenger_show_version_in_header
is now only valid in thehttp
context. - [Apache] The
PassengerStatThrottleRate
option is now global.
Minor changes:
- The minimum required Nginx version is now 1.6.0.
- The instance directory is now touched every hour instead of every 6 hours. This should hopefully prevent more problems with /tmp cleaner daemons.
- Applications are not grouped not only on the application root path, but also on the environment. For example, this allows you to run the same app in both production and staging mode, with only a single directory, without further configuration. Closes GH-664.
- The
passenger_temp_dir
option (Nginx) and thePassengerTempDir
option (Apache) have been replaced by two config options. On Nginx they arepassenger_instance_registry_dir
andpassenger_data_buffer_dir
. On Apache they arePassengerInstanceRegistryDir
andPassengerDataBufferDir
. On Apache,PassengerUploadBufferDir
has been replaced byPassengerDataBufferDir
. - Command line tools no longer respect the
PASSENGER_TEMP_DIR
environment variable. UsePASSENGER_INSTANCE_REGISTRY_DIR
instead. passenger-status --show=requests
has been deprecated in favor ofpassenger-status --show=connections
.- Using the SIGUSR1 signal to restart a Ruby app without dropping connections, is no longer supported. Instead, use
passenger-config detach-process
. - Introduced the
passenger-config reopen-logs
command, which instructs all Phusion Passenger agent processes to reopen their log files. You should call this after having rotated the web server logs. - [Standalone] The Phusion Passenger Standalone config template has changed. Users are encouraged to update it.
- [Standalone]
passenger-standalone.json
has been renamed toPassengerfile.json
. - [Standalone]
passenger-standalone.json
/Passengerfile.json
no longer overrides command line options. Instead, command line options now have the highest priority.
Installing or upgrading
Here’s a quickstart:
gem install passenger --pre -v 5.0.0.beta1
cd /path-to-your-app
passenger start
The above is a very short excerpt of how to install or upgrade Phusion Passenger. For detailed instructions (which, for example, take users and permissions into account), please refer to the “RubyGems” section of the installation manuals:
Please note:
- 5.0.0 beta 1 is a beta release. It may still have bugs and we do not recommend using it in production yet.
- There are no Homebrew or Debian packages for this release, because this release is still in beta!
- There is also a 5.0.0 beta 1 release of Phusion Passenger Enterprise available. Please refer to the Customer Area.
Baseimage-docker 0.9.15 released
Baseimage-docker is a special Docker image that is configured for correct use within Docker containers. It is Ubuntu, plus modifications for Docker-friendliness. You can use it as a base for your own Docker images. Learn more at the Github repository and the website, which explain in detail what the problems are with the stock Ubuntu base image, and why you should use baseimage-docker.
Changes in this release
- Fixed the setuid bit on /usr/bin/sudo. This problem was caused by Docker bug #6828.
Using baseimage-docker
Please learn more at the README.
Phusion Passenger 4.0.53 released
Phusion Passenger is a fast and robust web server and application server for Ruby, Python, Node.js and Meteor. Passenger takes a lot of complexity out of deploying web apps, and adds powerful enterprise-grade features that are useful in production. High-profile companies such as Apple, New York Times, AirBnB, Juniper, American Express, etc are already using it, as well as over 350.000 websites.
Phusion Passenger is under constant maintenance and development. Version 4.0.53 is a bugfix release.
Phusion Passenger also has an Enterprise version which comes with a wide array of additional features. By buying Phusion Passenger Enterprise you will directly sponsor the development of the open source version.
Recent changes
- Upgraded the preferred Nginx version to 1.6.2.
- Improved RVM gemset autodetection.
- Fixed some Ruby 2.2 compatibility issues.
Installing or upgrading to 4.0.53
![]() |
![]() |
![]() |
![]() |
![]() |
![]() |
Final
Phusion Passenger’s core is open source. PleaseIf you would like to stay up to date with Phusion news, please fill in your name and email address below and sign up for our newsletter. We won’t spam you, we promise.
Baseimage-docker 0.9.14 released
Baseimage-docker is a special Docker image that is configured for correct use within Docker containers. It is Ubuntu, plus modifications for Docker-friendliness. You can use it as a base for your own Docker images. Learn more at the Github repository and the website, which explain in detail what the problems are with the stock Ubuntu base image, and why you should use baseimage-docker.
Changes in this release
- Installed all the latest Ubuntu security updates. This patches Shellshock, among other things.
- Some documentation updates by andreamtp.
Using baseimage-docker
Please learn more at the README.
RSVP Now: The Future of App Deployment
Phusion will be traveling across the US this October to give tech talks on their future vision of app deployment. We’ve been working on some pretty exciting stuff and our friends over at AirBnB and ConstantContact have generously offered to host us over at their San Francisco and Waltham offices respectively to talk about this:
Writing an app is one thing, deploying it to a production ready environment and keeping it online in the face of countless potential scenarios of adversity is an entirely different beast. Not only does it currently still involve a fair bit of expertise when it comes to unix-fu, it also involves keeping an eye out on the latest software and configure them properly to combat things like security breaches. This is all generally considered tedious and cumbersome work, and often outside the domain of knowledge of developers. Wouldn’t it be great if we didn’t need to go through as many hoops as we need to do today and make it more developer friendly?
This talk will go over the most important steps currently involved in setting up a production environment for your a web app and will propose alternative approaches as well in the form of new software solutions developed by Phusion. This talk will focus on app deployment, monitoring and server provisioning, but will also touch upon topics such as UI design and UX as the latter plays an important part in making things more accessible. More specifically, we’ll discuss Docker, Polymer, Node, Rails, Phusion Passenger, Union Station and much more.
RSVP to attend!
Date | Location | Details/RSVP |
Oct 23rd, 2014 — 6:00pm — 8:00pm | Constant Contact Waltham Office | Rails Boston Meetup.com |
Oct 29th, 2014 — 6:00pm – 8:00pm | AirBnB SF HQ | AirBnB Meetups |
Get notified about our tech talk recording
Unable to attend? No worries! We’ll be giving this series of tech talks over at our friends at Twitter too, who have generously offered to record it. We expect to be able to post it up online sometime in the future. Be sure to follow us on @phusion_nl and/or sign up to our newsletter to stay in the loop on this.
On behalf of the Phusion team, we’re looking forward to meeting up with you next month!

Security advisory: Phusion Passenger and the CVE-2014-6271 Bash vulnerability
On 24 September 2014, an important security vulnerability for Bash was published. This vulnerability, dubbed “Shellshock” and with identifiers CVE-2014-6271 and CVE-2014-7169, allows remote code execution.
This vulnerability is not caused by Phusion Passenger, but does affect Phusion Passenger. We strongly advise users to upgrade their systems as soon as possible. Please note that while CVE-2014-6271 has been patched, CVE-2014-7169 isn’t. A fix is still pending.
Update: CVE-2014-7169 has been patched in Debian 7. Other operating system vendors may follow soon.
For details about how Phusion Passenger is related to this vulnerability, please refer to https://news.ycombinator.com/item?id=8369776.
Please refer to your operating system vendor’s upgrade instructions, for example:
- Ubuntu Linux: http://www.ubuntu.com/usn/usn-2362-1/
- Debian Linux: https://www.debian.org/security/2014/dsa-3032
- RedHat Linux: https://access.redhat.com/articles/1200223
- Amazon Linux: https://alas.aws.amazon.com/ALAS-2014-418.html