gunicorn + nginx: Server via socket or proxy?

Question

I've seen two strategies for hosting a django application with gunicorn and nginx.

One strategy is to run gunicorn on a network port. For example (from http://goodcode.io/blog/django-nginx-gunicorn/):

location / {
    proxy_pass_header Server;
    proxy_set_header Host $http_host;
    proxy_redirect off;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Scheme $scheme;
    proxy_connect_timeout 10;
    proxy_read_timeout 10;
    proxy_pass http://localhost:8000/;
}

Another strategy is to bind gunicorn to a UNIX socket on startup (e.g. http://michal.karzynski.pl/blog/2013/06/09/django-nginx-gunicorn-virtualenv-supervisor/)

upstream hello_app_server {
    server unix:/tmp/gunicorn.sock fail_timeout=0;
}

...

location / {
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header Host $http_host;
    proxy_redirect off;
    if (!-f $request_filename) {
        proxy_pass http://hello_app_server;
        break;
    }
}

Thoughts on which strategy is superior? Any any comments on the proper way to do each? I am leaning towards the socket approach because of the overhead I imagine is introduced by TCP. I am most concerned about the differences about headers, connect timeouts and such between implementation examples I have seen.

Answer 1

Besides the small TCP/IP overhead, there's not much of a difference. Each listen() socket gets a connection queue, and accept() just pops a connection from that queue. In gunicorn each worker just pops a new connection from that queue as its able so that won't change. The difference is performance (sockets being a bit faster) and portability (port:IP is more flexible). Unix domain sockets will give you a bit better performance, while a socket connected to localhost gives you a bit better portability if you move the server app to a different OS, you can do so by just changing the IP address from localhost to a different hostname.

Answer 2

Here are the results of my test TCP Proxy via Unix socket:

Setup: nginx + gunicorn + django running on 4 m4.xlarge nodes on AWS.

1 million of requests are made over about 30 minute window:

one instance is at 100% and 3 others are all 70% CPU.

TCP vs. socket is virtually identical Timing for making 1000000 requests

is 27 minutes for TCP proxy

and 31 minutes for the unix socket.

In this particular setup no unix socket performance advantage.

Answer 3

would prefer socket traffic over TCP/IP since no extra port is needed to be open. the less ports open the the more hardened your system becomes

as suggested here "be paranoid" https://hynek.me/talks/python-deployments/

"UNIX file sockets with restrictive permissions are your friends. And you can stop coming up with port numbers"

Answer 4

I know I'm late to this party, bit this may be of use, if you are trying to get this to work on Red Hat flavour Linux with SELinux enforcing.

It gets in the way badly if you try to use sockets. I gave up.

It also gets in the way if you try to bind Gunicorn via an arbitrary TCP Port. By default (on Centos 1708) there is a subset of ports which SELinux is happy for you to use: 80,81,443,488,8008,8009,8443,9000

I went with 8009 but apparently for some other port you can use

semanage -a -t http_port_t -p tcp $PORTNUMBER

and to see the list of ports

semanage port -l

Answer 5

Socket traffic will be an easy choice if both your webserver and app server(wsgi) exist on the same machine. However you will need network ports over network connections as sockets cannot work over network so..

1. If webserver and appserver lie on same machine - GO SOCKET
2. If webserver and appserver are on network - GO PORTS