[Mongrel] The Debian Plan - reloaded

Kyle Kochis kylekochis at gmail.com
Fri Jan 12 11:09:33 EST 2007


Jens,
Good point, at least on the first two paragraphs but I must
respectfully (yet enthusiastically) disagree on the last point:

> Besides that, it's just a waste of resources to compile anything on
> *each* production machine in case of an upgrade. Your average web server
> shouldn't even need to have a compiler installed, imho. I've never heard
> of someone compiling tomcat or java on a live machine...

As a user of Debian (it is my preferred Linux Distro although I am
starting to shift towards the BSD's), it is a pain in the butt to use
Ruby1.8.2 or 1.6 and get everything like gems and rails working
properly. Take a look at
http://mongrel.rubyforge.org/docs/debian-sarge.html and
http://lists.rubyonrails.org/pipermail/rails/2006-May/037763.html. The
issue mentioned in both of these articles are VERY easy to avoid:
curl, tar, cd ./configure make and finally make install. Not only that
but since most VPS/Dedicated servers that host only one or maybe up to
5 (busy) sites that I set up at least don't need java, tomcat, php or
anything else except what helps with their ruby needs.
Additionally, I find that Debians speed on updating Ruby's packages is
not very good when there is a new security or bugfix version out. This
goes for every other distro i've seen as well so I am not bashing
Debian, I am just trying to show that a compiler can be an important
thing on a production server. Additionally, I use nginx as I have
found it to be great for running with ruby on mongrel but currently
the unstable and testing branches of debian still have version
0.4.13-2 and because nginx updates constantly it's latest stable
version is 0.5.6. I'm not the kind of guy that likes to wait a year or
so for it to be updated in debian again. same goes with Mongrel. If
you have Ruby you should RubyGems and if you have that then it is SO
easy to get mongrel. I have nothing against debian adding mongrel to
apt but I personally will never use it.
One last point: Like any debian guy, I care about security and want to
have the latest patches and regularly do apt-get update and upgrade.
But because I manage a few high traffic sites that use ruby I also
must have plan if one (or more) of the sites get exploited because of
a new found security issue in ruby (or anything else for that matter).
Perhaps there are no new versions out that address this issue but
after some searching I find the root of the problem and make a patch.
So I use that patch to compile a secure version of that once exploited
software.

PLEASE: I do not want to start a flame war here and I really do like
debian and apt but I have to disagree with the philosophy of never
needing a compiler. thanks for listening to my rampling.


More information about the Mongrel-users mailing list