Puma
A Ruby app server that runs Rails apps, often behind a front end such as nginx.
Where It Sits
The small stack marks its layer. Beside it, each related technology links to its own page.
- App
- Framework
- Web ServerPuma
- Runtime
- Containers
- OS
- Hypervisor
- Firmware
- Hardware
- Data
About
Puma is the app server Rails uses by default. It runs the app's Ruby code across threads and worker processes and answers the requests that reach it. GitLab runs its Rails code on Puma too. Puma can face the internet itself, but it often sits behind a front end such as nginx, usually on Linux.
How to Spot It
These are signs that a system runs Puma, seen from outside without signing in, such as a response header, a cookie, a path or a default port. They help you find where it runs across your own estate. A version shown to the world also tells anyone scanning which flaws might apply, so it is worth hiding.
- Default port
9292 (Puma started on its own)- Common port
3000 (the rails server default)- Error page (development mode)
Puma caught this error: Invalid HTTP format, parsing fails.
If It Has a Flaw
Puma runs the app's Ruby code, so a flaw in it reaches every app it runs and what those apps can touch. Several of its past flaws were request smuggling, where Puma and the front end read a request's length differently, so an unchecked request could slip past the front end.
A flaw exposes what runs on it and the data it reaches.
- Application
GitLab- Framework and Libraries
Ruby on Rails- Data
PostgreSQL
Redis
Rivals
Rivals do the same job on the same layer, so a system usually runs one of them in any one place. A flaw in a rival does not reach Puma.
Stacks and Code
Puma is part of the common stacks below, and each stack's page shows who runs every layer. Its code arrives from the sources listed, and each source's page says how bad code could get in through it.
- In Common Stacks
- A Rails App on Puma
- Its Code Comes From
RubyGems