FEATURES

Everything the stack did, one process does

Execution model, HTTP delivery, shared state, observability and security are built in, either on by default or one environment variable away. You don't write nginx configs, run sidecars or compile plugins.

Run PHP

Execution model

Persistent workers, cooperative fibers and true background threads give you control over the request lifecycle.

Persistent PHP workers bootstrap once and handle thousands of requests. Superglobals, buffers and headers soft-reset between requests; autoloaders, containers and DB connections persist.

Each worker handles hundreds of concurrent requests via PHP Fibers. Sleeps and awaits yield the fiber instead of blocking the thread, and with runtime hooks so do native sleep(), socket reads, connects and TLS waits.

Dispatch closures to a dedicated thread pool and await the results. The all, race and any combinators handle parallel fan-out.

Send the response to the client immediately, then keep processing in the background: queue jobs, write logs, warm caches.

Intercept function and method calls with PHP 8 attributes to retry, cache, trace or guard them without touching call sites.

Real-time Server-Sent Events straight from PHP, with explicit flush control and no surprises from proxy buffering.

Serve

HTTP & delivery

The web-server layer nginx used to own (routing, static files, TLS, compression and protection), configured with environment variables.

Traditional file mapping, framework front-controller, or SPA fallback, switched by one variable. Worker mode stacks on top of any of them.

In-memory content cache, automatic MIME detection, ETag and Last-Modified headers, streaming for large files.

Zstandard, Brotli and gzip out of the box, negotiated per client by q-value with a level per codec. Cached static files get a precompressed Brotli copy.

TLS termination from two variables (PEM certificate and key), with the minimum protocol version enforced at startup.

Per-IP limits with configurable windows. Over-limit requests get 429; a full PHP queue answers 529 backpressure.

Header-read timeout against Slowloris, request timeouts, and a graceful drain window on shutdown.

Your own HTML per status code: drop 404.html or 503.html in a directory and point one variable at it.

SIGTERM drains in-flight connections before exit, so rolling deploys don't drop requests.

Coordinate

Shared state

Process-wide concurrent primitives so workers coordinate without Redis or APCu. In-process operations take microseconds instead of network round-trips.

Counter

15

Atomic int64 accumulator with get, set, add and compareAndSet.

Atomic

16

Int64 with explicit memory-ordering control.

Flag

17

Atomic boolean for one-shot transitions.

Once

18

Run-once container with reentrancy-safe factory.

Mutex

19

Poisoning mutex over a stored value, with deadlock detection.

Channel

20

Bounded, fiber-aware MPMC queue between workers.

Map

21

Concurrent string-keyed store with batched access.

Pool

22

Bounded object pool with per-thread affinity.

Observe

Observability

Metrics, logs, traces and profiles are built into the server. You don't need exporters, sidecars or code changes.

A dedicated internal port exposes request, worker, queue, cache and async metrics, ready for Grafana.

JSON access logs with method, path, status, duration and request ID in every line. Loki and Elasticsearch parse them as-is.

X-Request-ID generated or passed through automatically, available in PHP and stamped on every log line.

W3C Trace Context, OpenTelemetry export, auto-instrumentation of PDO, cURL and Redis, plus a PHP tracing SDK.

Per-request profiles in xhprof, speedscope, pprof and FlameGraph formats, triggered by header, cookie or sampling.

Liveness and readiness endpoints plus a live configuration snapshot. Kubernetes probes work out of the box.

Protect

Security

Sensible protections on by default, and deny-lists for the sharp edges of legacy PHP apps.

Hidden files and directories (.env, .git/, .htaccess) are never served. This is on by default and needs no configuration.

Real client IP from Forwarded (RFC 7239), X-Forwarded-* and, behind Cloudflare, CF-Connecting-IP. Trust is given as CIDRs and keywords like private and cloudflare, and the address is resolved rightmost-non-trusted.

Block .php execution at writable paths like /uploads/**, so uploaded-shell attacks on legacy apps die before disk I/O.

Symlink escapes from the document root are blocked unless explicitly allow-listed. Laravel storage:link still works.

A .gitignore-style .oxphpdeny keeps vendor/, SQL dumps and backups from being served. It covers static files and PHP alike, in every routing mode, and is checked before any disk access.

Two lines in a Dockerfile

Copy your app into the image and run it.