Search code examples
pythonperformancesecuritywebserverbottle

What is wrong with Bottle's or Flask's built-in HTTP server


This might be a bit ignorant question, but why everyone is saying [1,2,...] that Flask and/or Bottle HTTP servers are not to be used in production?

Seems like things have changed a lot, for example bottle+ssl+gevent sounds like a viable option for production (to me) which handles the main concerns:

  • Security (ssl)
  • Multiple/parallel requests (gevent)

Am I missing something, like a major security risk? or a performance issue? I mean how much faster might nginx or apache2 be when the major bottleneck is IO?

(Side-question: what you suggest for micro-service deployment with minimal system requirements?)

Cheers


Solution

  • The short answer is that default server is slow and not concurrent. You asked whats wrong with bottle+gevent (leaving aside ssl for now), I don't see anything wrong but it is not the default server :)

    for small deployment your option seems reasonable but when it will grow bigger and more complex nginx will be a more simple tool to manage since it will separate your concerns (static vs dynamic routing & ssl).

    Nginx for example have a much more robust and variable options on ssl handling then the more native approach

    But as I said, If you are doing a small setup, keep it simple :)