Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
enhancer-recluster
Advanced tools
Clustering library with support for zero-downtime reloading
If server.js is your regular http server (e.g. express), create cluster.js and add:
var recluster = require('recluster'),
path = require('path');
var cluster = recluster(path.join(__dirname, 'server.js'));
cluster.run();
process.on('SIGUSR2', function() {
console.log('Got SIGUSR2, reloading cluster...');
cluster.reload();
});
console.log("spawned cluster, kill -s SIGUSR2", process.pid, "to reload");
then run it
node cluster.js
To hot-reload the server, simply run
kill -s SIGUSR2 <cluster_pid>
To find out which of the N (= number of cores by default) worker instances you're running from inside server.js, you can use
process.env.WORKER_ID
which is zero-based i.e. 0 <= WORKER_ID < N
var cluster = recluster(file, opt)
where
Absolute path to the module that defines the server
Number of active workers (default = cores)
Timeout to kill old workers after reload (seconds).
Defaults to 1 second in development, 1 hour in production.
Minimum time between worker respawns when workers die (seconds)
Maximum respawn time (reached via exponential backoff). Set to 0 or undefined to disable exponential backoff.
Use 'listening'
for servers (e.g. for express/connect http servers)
and 'started'
for workers that are immediately ready.
If you want to manually tell recluster when the worker is ready to replace
older workers you can use {readyWhen: 'ready'}
. Then, to signal readiness
from the worker use process.send({cmd: 'ready'})
Array of arguments to pass to the worker
Log various events to stdout. Currently only 'respawns' is supported.
Default: {respawns: true}
Which logger to use. Requires a console-compatible log method
Default: console
The returned object has the following methods:
Starts the cluster by running child processes
Hot-reloads new code. some of the children will remain active
for opt.timeout
seconds after reload
Terminates the entire cluster and removes all listeners.
Returns a hash of all worker slots (0 <= WORKER_ID < N). If a worker isn't available at that slot, the value in the hash is null or undefined. Otherwise, the value will be a worker object that is ready to serve requests.
Returns an array of all the workers, including those that are not yet ready or those that will be replaced.
A server worker can gracefully exit by cleaning up in the 'close' event of its server:
server.on('close', function() {
// cleanup
});
Non-server workers can listen for the disconnect command and shut down gracefully before the kill timeout:
process.on('message', function(m) {
if (m.cmd == 'disconnect') {
// cleanup
}
})
If you need sticky sessions e.g. for socket.io you can use the experimental companion module sticky-listen, which implements an alternate balancer that distributes the sockets based on the client IP (instead of the regular round-robin one)
FAQs
Clustering library with support for zero-downtime reloading
We found that enhancer-recluster demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.