In February 2001 the Netcraft Web Server Survey counts 16,871,744 sites served by Apache, 59.99% of those found; Microsoft-IIS sits at 19.64%. The month before, Apache was at 58.75%: its share rises while IIS slips. These numbers make an Open Source server an ordinary piece of Web infrastructure, and it is worth looking at how it is built and how it is kept running, because the two hold together.

Context

Apache began in 1995, from a group of administrators maintaining scattered patches for NCSA HTTPd, the server whose development had stalled. Gathering those patches into a coherent distribution — “a patchy server” — is where the name and the project come from. The stable version in production today is 1.3, with 1.3.17 released in January 2001; it runs on Unix, Linux, and Windows. In parallel runs 2.0, still at the alpha stage.

To whoever installs it and whoever studies it the server is the same object: a binary that listens on a TCP port, speaks HTTP/1.1 (RFC 2616, June 1999), and maps requests onto files or handlers. Two things set it apart: how it handles concurrency and how the code gets decided.

Prefork architecture

Apache 1.3 uses a prefork model. At startup the parent process opens the listening socket, then forks a set of child processes; each child follows one connection at a time, from accept() to close, then returns to waiting. The parent serves no requests: it watches the children and adjusts their count to the load, within the bounds set by MinSpareServers, MaxSpareServers, and MaxClients in httpd.conf.

The choice has precise consequences. Each child is a separate process with its own address space: a segmentation fault in a handler kills that child and nothing else, and the parent replaces it. This is the main reason 1.3 copes well with third-party modules written in C, where a stray pointer always slips in. The price is memory: with a few hundred children, each with its own copy of the structures and loaded modules, consumption grows linearly with concurrency. For many Web workloads — short requests, plenty of static files, peaks held in check by MaxClients — the trade holds. Where connections are in the thousands, slow and kept open, one process per connection costs dear.

Modules extend the core without recompiling it, linked statically or loaded as shared objects through mod_so. mod_rewrite rewrites URLs with regular expressions; mod_ssl adds TLS on top of OpenSSL; mod_proxy acts as forward and reverse proxy; virtual hosts let a single physical host serve hundreds of distinct domains, each with its own document root. Configuration lives in httpd.conf and in .htaccess files, read per directory on every request — handy for delegating rules without a restart, but with a filesystem-access cost not to forget.

The critical point

The 2.0 tree under development rewrites exactly the layer 1.3 takes for granted. Two pieces.

The first is the Multi-Processing Modules (MPMs): the concurrency model becomes a swappable module rather than a choice wired into the core. On Unix this opens the way to a hybrid process-and-thread MPM — a pool of processes, each with several threads following one connection apiece — which cuts the number of processes, and therefore the memory, for the same number of connections served. On Windows a dedicated MPM replaces the adaptations 1.3 was forced to make on a system without fork().

The second is the Apache Portable Runtime (APR), the layer that abstracts sockets, memory, files, and threads behind one API, so modules do not call the operating system’s system calls directly. The ASF board set up APR as a project in its own right on 20 December 2000: portability stops being a side effect of the server and becomes a library with a life of its own. This is the difference between “Apache also runs on Windows” and “there is a portable base on which Apache, and more, can run”.

Implications: licence and consensus

The code is one part. The other is how it is decided what enters it, and under what terms it is distributed.

The licence is the Apache Software License, in the 1.1 version adopted in 2000. Against 1.0 it has one clause fewer: 1.0 required an attribution line in the advertising materials of every derived product — the same “advertising clause” that made the original BSD licence awkward when many components were combined. Version 1.1 moves attribution into the documentation and drops it from advertising. It is a permissive licence: Apache can be put into a proprietary product with no obligation to release the source, unlike the GPL. That is part of why so many vendors have built on Apache without legal friction.

The governance is that of the Apache Software Foundation, set up in 1999 as a non-profit in Delaware. The model is explicit: commit rights are earned through sustained contributions that peers assess, decisions are taken by consensus on the developers’ mailing list, and where consensus does not come a vote is held under known rules. A veto on a code change must be justified on technical grounds; casting it is not enough. The procedure costs time but yields continuity: the project depends on no single person and no single company, and it has been able to carry the deep rewrite of 2.0 without splitting. The ASF has extended the same framework to other projects — from Jakarta to the XML tools — and made it a reusable method rather than a one-off.

Limits

Netcraft’s numbers count host names that answer, not machines and not traffic: a 60% share of the sites found does not translate into an equal share of traffic or of physical servers, and parked hosts weigh on the total. The 1.3 prefork must be measured against its own load, not in the abstract: where connections are many and slow, the 2.0 tree under development is already worth a look, the alpha state taken into account. And a permissive licence is a choice, not an absolute: anyone who wants modifications to stay open will find in the GPL guarantees the Apache License does not give. Concurrency, licence, and governance have to be decided together, because together they say whether a server holds up in production and over time.

https://httpd.apache.org/ https://www.netcraft.com/survey/ https://www.apache.org/licenses/LICENSE-1.1 https://www.apache.org/foundation/ https://www.ietf.org/rfc/rfc2616.txt https://www.noze.it/en/insights/apache-httpd-open-source/

Cover image: Roy Fielding, bearded and wearing glasses, speaking into a microphone at an open source conference — photo by Phil Whitehouse, CC BY 2.0 — https://commons.wikimedia.org/wiki/File:Roy_Fielding.jpg