Runtime
Runs the application code. Technologies here are rivals, not layers.
What It Is
A runtime is the program that runs code written in one language. PHP runs PHP code, Node.js runs JavaScript outside the browser, Java runs Java, Python runs Python and .NET runs C#. Until a runtime carries them out, the application and its framework are just files of instructions.
Runtimes on this layer are rivals, not layers of each other. Node.js is an alternative to PHP, and neither runs on the other. A runtime is not a web server either. Node.js can take web requests itself, while PHP is handed each request by Apache or by PHP-FPM, its own process manager.
A runtime is installed on the operating system, or shipped inside a container image with the app. It has its own versions and security updates, separate from the app's code.
- App
- Framework
- Web Server
- Runtime
- Containers
- OS
- Hypervisor
- Firmware
- Hardware
- Data
On This Layer
These are the technologies on the Runtime layer that this topic covers. Open one to see what it runs on, how to spot it and what a flaw in it reaches.
.NETMicrosoft's runtime for C# and other .NET languages.
PHPA language and runtime for server-side web code.
Node.jsA runtime that runs JavaScript on the server and can serve HTTP itself.
JavaA runtime that runs compiled Java code on almost any operating system.
PythonA general-purpose language and runtime, popular for web apps.
RubyA language and runtime behind Rails and GitLab.
How Far a Flaw Reaches
A flaw in a runtime reaches every application it runs on that machine, beneath any one app's own defences. That is why PHP2Shell, a pair of flaws in PHP itself, put every PHP site on an unpatched server at risk at once.