服务器与烧瓶捆绑在一起在生产中使用是否安全？

与 Flask 绑定的服务器对于生产环境中的部署是否安全？如果没有，我应该使用什么来在生产中部署 Flask？

91812 次浏览
小开

Basically, no. The built-in development server is not safe for deployment in a production environment.

The built in development server is for just that. For use in production you should follow one of the steps detailed here.

These include different servers that implement the WSGI specification, such as Apache/mod_wsgi or one of these stand-alone wsgi server http://flask.pocoo.org/docs/deploying/wsgi-standalone/

There are also uWSGI and FastCGI options available

小开

No. The bundled server is a development server. It's not designed with production environments in mind.

  • It will not handle more than one request at a time by default.
  • If you leave debug mode on and an error pops up, it opens up a shell that allows for arbitrary code to be executed on your server (think os.system('rm -rf /')).
  • The development server doesn't scale well.

Flask uses Werkzeug's development server, and the documentation says the same thing:

The development server is not intended to be used on production systems. It was designed especially for development purposes and performs poorly under high load. For deployment setups have a look at the Application Deployment pages.

The recommended approach is to use a production WSGI server to run your Flask application. There's a whole section dedicated to deployment in the docs: Deployment Options.

Deploying your application is as simple as installing a WSGI server like uWSGI or gunicorn and running that instead of Flask's development server:

gunicorn -w 4 -b 127.0.0.1:4000 myproject:app

If you are serving any static assets like images or videos, need low-level caching, or have higher concurrency demands, it's recommended to use a webserver like nginx and have it handle all of your requests.

In crappy ASCII form:

                +----------+
| Client 2 |
+----------+
|
V
+----------+      +-------+      +----------+
| Client 1 |----->| nginx |<-----| Client 3 |
+----------+      +-------+      +----------+
^
|
V
/--------------------\
| useful nginx stuff |
| like asset serving |
| and rate limiting  |
\--------------------/
|
V
+-------------+
| WSGI server |
+-------------+

To actually run the WSGI server process, you can use Supervisor. It automatically restarts the server if it fails for some reason, keeps logs, and runs as a daemon so your service starts when the server boots.

小开

While lightweight and easy to use, Flask’s built-in server is not suitable for production as it doesn’t scale well and by default serves only one request at a time. http://flask.pocoo.org/docs/0.12/deploying/


提交答案