Worker mode
01Persistent PHP processes bootstrap once and handle thousands of requests. Superglobals, buffers and headers soft-reset between requests; autoloaders, containers and DB connections persist.
Everything the stack did, one binary does
Execution model, HTTP delivery, shared state, observability and security — built in, on by default or one environment variable away. No nginx configs, no sidecars, no plugins to compile.
Run PHP
Execution model
Persistent workers, cooperative fibers and true background threads — the request lifecycle is yours to shape.
Fiber multiplexing
02Each worker handles hundreds of concurrent requests via PHP 8.4 Fibers — sleeps and awaits yield the fiber instead of blocking the thread.
Async promises
03Dispatch closures to a dedicated thread pool and await results — with all, race and any combinators for parallel fan-out.
Early response
04Send the response to the client immediately, then keep processing in the background — queue jobs, write logs, warm caches.
Decorators
05Intercept function and method calls with PHP 8 attributes — retry, cache, trace or guard without touching call sites.
SSE streaming
06Real-time Server-Sent Events straight from PHP with explicit flush control — no proxy buffering surprises.
Serve
HTTP & delivery
The web-server layer nginx used to own — routing, static files, TLS, compression and protection — configured with environment variables.
Three routing modes
07Traditional file mapping, framework front-controller, or SPA fallback — one variable switches; worker mode stacks on top of any of them.
Static files
08In-memory content cache, automatic MIME detection, ETag and Last-Modified headers, streaming for large files.
Brotli compression
09Text responses compressed out of the box — quality tunable 0–11, bytes-saved exposed as a metric.
Built-in TLS
10TLS termination with two variables — PEM certificate and key, minimum protocol version enforced at startup.
Rate limiting
11Per-IP limits with configurable windows. Over-limit requests get 429; a full PHP queue answers 529 backpressure.
Timeouts
12Header-read timeout against Slowloris, request timeouts, and a graceful drain window on shutdown.
Custom error pages
13Your own HTML per status code — drop 404.html or 503.html in a directory and point one variable at it.
Graceful shutdown
14SIGTERM drains in-flight connections before exit — rolling deploys without dropped requests.
Observe
Observability
Metrics, logs, traces and profiles are built into the server — no exporters, no sidecars, no code changes.
Prometheus metrics
23A dedicated internal port exposes request, worker, queue, cache and async metrics — ready for Grafana.
Structured logging
24JSON access logs with method, path, status, duration and request ID in every line — Loki and Elasticsearch parse them as-is.
Request IDs
25X-Request-ID generated or passed through automatically, available in PHP and stamped on every log line.
Tracing & APM
26W3C Trace Context, OpenTelemetry export, auto-instrumentation of PDO, cURL and Redis, plus a PHP tracing SDK.
Built-in profiler
27Per-request profiles in xhprof, speedscope, pprof and FlameGraph formats — triggered by header, cookie or sampling.
Health checks
28Liveness and readiness endpoints plus a live configuration snapshot — Kubernetes probes work out of the box.
Protect
Security
Sensible protections on by default, and deny-lists for the sharp edges of legacy PHP apps.
Dot-path blocking
29Hidden files and directories — .env, .git/, .htaccess — are never served. On by default, no configuration.
Trusted proxies
30Real client IP from Forwarded (RFC 7239) and X-Forwarded-* headers, with CIDR-based trust and rightmost-non-trusted resolution.
PHP execution deny-list
31Block .php execution at writable paths like /uploads/** — uploaded-shell attacks on legacy apps die before disk I/O.
Symlink allow-paths
32Symlink escapes from the document root are blocked unless explicitly allow-listed — Laravel storage:link still works.
Two lines in a Dockerfile
Copy your app into the image and run it.