> ## Documentation Index > Fetch the complete documentation index at: https://developer.upsun.com/llms.txt > Use this file to discover all available pages before exploring further. # How It Works ![Airflow on a locked-down platform](https://developer.upsun.com/images/posts/devcenter.webp) how-it-works Tuesday, September 22nd 2026 ### [Airflow on a locked-down platform](https://developer.upsun.com/posts/how-it-works/airflow-on-a-locked-down-platform) Running Apache Airflow on Upsun's hardened containers takes 30 lines of C and a decision about how much task isolation you actually want back. ![How to host a website that isn't publicly reachable](https://developer.upsun.com/images/posts/devcenter.webp) how-it-works Thursday, September 3rd 2026 ### [How to host a website that isn't publicly reachable](https://developer.upsun.com/posts/how-it-works/how-to-host-a-website-that-isnt-publicly-reachable) Some applications should never answer a request from the open internet. Here are the ways to make one unreachable on Upsun, and how to pick between them. ![Why Let's Encrypt certificate renewals fail](https://developer.upsun.com/images/posts/devcenter.webp) how-it-works Tuesday, August 25th 2026 ### [Why Let's Encrypt certificate renewals fail](https://developer.upsun.com/posts/how-it-works/why-lets-encrypt-certificate-renewals-fail) Certificate renewals fail for a handful of recurring reasons. Here's how the HTTP-01 challenge works and what breaks it, from IPv6 records to CDN rules. ![How SSH authentication works on Upsun Cloud](https://developer.upsun.com/images/posts/devcenter.webp) how-it-works Tuesday, August 18th 2026 ### [How SSH authentication works on Upsun Cloud](https://developer.upsun.com/posts/how-it-works/how-ssh-authentication-works-on-upsun) Decode the SSH certificate the Upsun CLI provisions for you, then follow it through the SSH proxy: CA trust, revocation, access documents, and MFA. ![Backup consistency: why it matters and how Upsun handles it](https://developer.upsun.com/images/posts/devcenter.webp) how-it-works Tuesday, July 21st 2026 ### [Backup consistency: why it matters and how Upsun handles it](https://developer.upsun.com/posts/how-it-works/backup-consistency-why-it-matters-and-how-upsun-handles-it) Learn what backup consistency means at the filesystem and service levels, and how Upsun balances consistent backups with zero-disruption live backups. ![Can you trust the X-Client-IP header?](https://developer.upsun.com/images/posts/devcenter.webp) how-it-works Tuesday, July 14th 2026 ### [Can you trust the X-Client-IP header?](https://developer.upsun.com/posts/how-it-works/can-you-trust-the-x-client-ip-header) Why the X-Client-IP header on Upsun holds the real visitor IP behind Fastly, Cloudflare, and CloudFront, and how to log real client IPs behind any other CDN. ![Write a Git server with per-branch permissions in five minutes](https://developer.upsun.com/images/posts/devcenter.webp) how-it-works Tuesday, July 7th 2026 ### [Write a Git server with per-branch permissions in five minutes](https://developer.upsun.com/posts/how-it-works/write-a-git-server-with-per-branch-permissions-in-five-minutes) Upsun's most basic API is a Git server. Build one in Python with Dulwich and Paramiko, and add per-branch read permissions in a single method. ![Cloning a terabyte in a minute, and the limit hiding behind it](https://developer.upsun.com/images/posts/devcenter.webp) how-it-works Tuesday, June 23rd 2026 ### [Cloning a terabyte in a minute, and the limit hiding behind it](https://developer.upsun.com/posts/how-it-works/cloning-a-terabyte-in-a-minute-and-the-limit-hiding-behind-it) Upsun clones a terabyte production environment in under a minute using Ceph copy-on-write. Here is the 16-level clone-depth limit behind it, why flattening is the price you pay, and what it says about engineering trade-offs. ![How redundancy and failover work on Upsun](https://developer.upsun.com/images/posts/devcenter.webp) how-it-works Tuesday, June 16th 2026 ### [How redundancy and failover work on Upsun](https://developer.upsun.com/posts/how-it-works/how-redundancy-and-failover-work-on-upsun) Upsun handles redundancy and failover inside your region, at the compute, storage, and network layers. Here's where it happens, how fast it is, and the trade-offs behind it. ![Upsun deployment hooks and commands: which one to use, and when](https://developer.upsun.com/images/posts/devcenter.webp) how-it-works Thursday, June 4th 2026 ### [Upsun deployment hooks and commands: which one to use, and when](https://developer.upsun.com/posts/how-it-works/upsun-deployment-hooks-and-commands-which-one-to-use-and-when) Build hooks, deploy hooks, pre\_start, start, and post\_start all shape how Upsun deploys your app. Learn what each one does and when to reach for it. ![Building observability from scratch, three times over](https://developer.upsun.com/images/posts/how-it-works/building-observability-from-scratch-three-times-over/building-observability-from-scratch-three-times-over.webp) how-it-works Tuesday, April 21st 2026 ### [Building observability from scratch, three times over](https://developer.upsun.com/posts/how-it-works/building-observability-from-scratch-three-times-over) A look back at how Platform.sh / Upsun's observability evolved from Nagios on a single box to a unified stack across thousands of VMs, and the migration patterns that made each transition smooth. ![How we caught a silent IO storm before it hit production](https://developer.upsun.com/images/posts/how-it-works/how-we-caught-a-silent-io-storm-before-it-hit-production/cgroup-v2-dirty-pages.png) how-it-works Tuesday, April 14th 2026 ### [How we caught a silent IO storm before it hit production](https://developer.upsun.com/posts/how-it-works/how-we-caught-a-silent-io-storm-before-it-hit-production) A sysctl setting that worked fine for years caused over 500 MB/s of disk writes after migrating to Debian 12. MariaDB stalled on pending IO, Redis complained about slow fsync, and RBD-backed storage ground to a halt. The culprit: cgroup v2 changes how the kernel divides dirty page budgets across containers. ![How Upsun provisions TLS certificates at scale](https://developer.upsun.com/images/posts/how-it-works/how-upsun-provisions-tls-certificates-at-scale/how-upsun-provisions-tls-certificates-at-scale.png) how-it-works Thursday, April 9th 2026 ### [How Upsun provisions TLS certificates at scale](https://developer.upsun.com/posts/how-it-works/how-upsun-provisions-tls-certificates-at-scale) Every Upsun environment gets HTTPS automatically. Here's how the certificate system works, from wildcards to Let's Encrypt automation. ![How Meta-Upsun improved Validation Schema and Developer eXperience](https://developer.upsun.com/images/posts/devcenter.webp) core-concepts Tuesday, April 7th 2026 ### [How Meta-Upsun improved Validation Schema and Developer eXperience](https://developer.upsun.com/posts/core-concepts/meta-upsun-validation-schema-dx-improvement) The introduction of Meta-Upsun enabled dynamic validation schemas and version enumeration for Upsun services and runtimes, significantly improving developer experience. ![Why we moved from LVM to Ceph for container storage](https://developer.upsun.com/images/posts/how-it-works/why-upsun-moved-from-lvm-to-ceph/why-upsun-moved-from-lvm-to-ceph.png) how-it-works Thursday, April 2nd 2026 ### [Why we moved from LVM to Ceph for container storage](https://developer.upsun.com/posts/how-it-works/why-upsun-moved-from-lvm-to-ceph) Upsun migrated from LVM to Ceph for container storage to separate compute from storage, enable instant volume migration, and make VMs disposable again. ![Centralising Upsun Technical References with Meta-Upsun](https://developer.upsun.com/images/posts/how-it-works/meta-reference-source-introduction/meta.webp) how-it-works Wednesday, March 25th 2026 ### [Centralising Upsun Technical References with Meta-Upsun](https://developer.upsun.com/posts/how-it-works/meta-reference-source-introduction) How Upsun centralised runtime, service, region, and PHP reference data into a single public API to improve consistency, automation, and documentation accuracy. ![How we host an RPM repository on AWS S3](https://developer.upsun.com/images/posts/how-it-works/rpm-repo-s3/rpm-logo.webp) how-it-works Tuesday, March 17th 2026 ### [How we host an RPM repository on AWS S3](https://developer.upsun.com/posts/how-it-works/rpm-repo-s3) Learn how to host an RPM repository entirely on AWS S3 with no active components, minimal cost, and authenticated access using IAM. ![Natural scaling for multi-country ecommerce](https://developer.upsun.com/images/posts/how-it-works/natural-scaling-for-multi-country-ecommerce/natural-scaling-for-multi-country-ecommerce.webp) how-it-works Thursday, March 12th 2026 ### [Natural scaling for multi-country ecommerce](https://developer.upsun.com/posts/how-it-works/natural-scaling-for-multi-country-ecommerce) Multi-country ecommerce is a textbook case for natural scaling. Instead of cramming every country into one store, give each its own. Here's why. ![Your WAF is buffering. Ours is streaming.](https://developer.upsun.com/images/posts/how-it-works/your-waf-is-buffering-ours-is-streaming/your-waf-is-buffering-ours-is-streaming.webp) how-it-works Wednesday, February 18th 2026 ### [Your WAF is buffering. Ours is streaming.](https://developer.upsun.com/posts/how-it-works/your-waf-is-buffering-ours-is-streaming) Most WAFs buffer your entire request before validating it. That's slow. Upsun's technical WAF validates requests while streaming them to your backend, so you don't pay a latency tax for security. ![Eliminating Database Password Risk with Network Isolation](https://developer.upsun.com/images/posts/core-concepts/eliminating-database-pwd-risk-with-network-isolation/database-security.webp) core-concepts Wednesday, February 4th 2026 ### [Eliminating Database Password Risk with Network Isolation](https://developer.upsun.com/posts/core-concepts/eliminating-database-pwd-risk-with-network-isolation) By removing default database passwords, Upsun reduces common credential risks (leaks, reuse, hardcoding) and relies on stronger security controls like SSH keys and private networking. ![SPF, DKIM, DMARC, what are those for anyway?](https://developer.upsun.com/images/posts/how-it-works/spf-dkim-dmarc-what-are-those-for-anyway/spf-dkim-dmarc-what-are-those-for-anyway.webp) how-it-works Thursday, January 29th 2026 ### [SPF, DKIM, DMARC, what are those for anyway?](https://developer.upsun.com/posts/how-it-works/spf-dkim-dmarc-what-are-those-for-anyway) Finally understand what SPF, DKIM, and DMARC actually do, why email needs them, and how to set them up without wanting to flip a table. ![How we've been hardening containers since before Docker made it cool](https://developer.upsun.com/images/posts/how-it-works/how-weve-been-hardening-containers-since-before-docker-made-it-cool/how-weve-been-hardening-containers-since-before-docker-made-it-cool.webp) how-it-works Tuesday, January 13th 2026 ### [How we've been hardening containers since before Docker made it cool](https://developer.upsun.com/posts/how-it-works/how-weve-been-hardening-containers-since-before-docker-made-it-cool) Docker's hardened images are great, but we've been doing this for years. Here's the automated pipeline that's been securing hundreds of container images behind the scenes at Upsun. ![Keeping the peace: how ZooKeeper stops database nodes from fighting](https://developer.upsun.com/images/posts/how-it-works/keeping-the-peace-how-zookeeper-stops-database-nodes-from-fighting/keeping-the-peace-how-zookeeper-stops-database-nodes-from-fighting.webp) how-it-works Tuesday, December 9th 2025 ### [Keeping the peace: how ZooKeeper stops database nodes from fighting](https://developer.upsun.com/posts/how-it-works/keeping-the-peace-how-zookeeper-stops-database-nodes-from-fighting) Learn how Upsun uses Zookeeper's sequences, watchers, and ephemeral nodes to coordinate MariaDB clusters and workers across distributed systems without breaking your application. ![When php-fpm runs out of workers: a 502 error field guide](https://developer.upsun.com/images/posts/how-it-works/when-php-fpm-runs-out-of-workers-a-502-error-field-guide/when-php-fpm-runs-out-of-workers-a-502-error-field-guide.webp) how-it-works Monday, November 24th 2025 ### [When php-fpm runs out of workers: a 502 error field guide](https://developer.upsun.com/posts/how-it-works/when-php-fpm-runs-out-of-workers-a-502-error-field-guide) Your PHP site keeps throwing 502 errors. Your CDN shows 503s. Learn why PHP-FPM workers get exhausted and how to diagnose and fix the real problems. ![We switched from LVM to... sparse files?!](https://developer.upsun.com/images/posts/how-it-works/we-switched-from-lvm-to-sparse-files/we-switched-from-lvm-to-sparse-files.webp) how-it-works Friday, November 14th 2025 ### [We switched from LVM to... sparse files?!](https://developer.upsun.com/posts/how-it-works/we-switched-from-lvm-to-sparse-files) How we eliminated 90% of VM evacuation time by replacing LVM with sparse files for temporary storage. A tale of inertia, performance bottlenecks, and surprisingly effective solutions. ![We made our infrastructure read-only and never looked back](https://developer.upsun.com/images/posts/how-it-works/we-made-our-infrastructure-read-only-and-never-looked-back/we-made-our-infrastructure-read-only-and-never-looked-back.webp) how-it-works Monday, November 3rd 2025 ### [We made our infrastructure read-only and never looked back](https://developer.upsun.com/posts/how-it-works/we-made-our-infrastructure-read-only-and-never-looked-back) Learn why read-only infrastructure eliminates entire classes of security attacks, improves reproducibility, and simplifies compliance while enabling predictable deployments. ![Event Loop Monitoring in Next.js: Performance Guide](https://developer.upsun.com/images/posts/how-it-works/event-loop-monitoring-in-nextjs-performance-guide/event-loop-monitoring-in-nextjs-performance-guide.webp) how-it-works Friday, October 24th 2025 ### [Event Loop Monitoring in Next.js: Performance Guide](https://developer.upsun.com/posts/how-it-works/event-loop-monitoring-in-nextjs-performance-guide) Learn to implement event loop monitoring in Next.js applications to identify blocking operations, optimize performance, and scale confidently with production-ready code. ![Auto-scaling on Upsun Flex. A deep dive.](https://developer.upsun.com/images/posts/how-it-works/autoscaling-deep-dive/autoscaling-deep-dive.webp) how-it-works Monday, October 20th 2025 ### [Auto-scaling on Upsun Flex. A deep dive.](https://developer.upsun.com/posts/how-it-works/autoscaling-deep-dive) Learn how Upsun's autoscaling dynamically adjusts application instances based on CPU usage, ensuring performance during traffic spikes while optimizing costs. ![Fake IP till you make IP](https://developer.upsun.com/images/posts/how-it-works/fake-ip-till-you-make-ip/fake-ip-till-you-make-ip.webp) how-it-works Tuesday, October 14th 2025 ### [Fake IP till you make IP](https://developer.upsun.com/posts/how-it-works/fake-ip-till-you-make-ip) How Upsun uses virtual IPs and NAT to keep your database connections stable even when containers move between VMs. A look at the networking tricks behind relationship stability. ![Mastering the Explore, Plan, Execute methodology for AI-assisted development](https://developer.upsun.com/images/posts/how-it-works/explore-plan-execute-methodology/explore-plan-execute-methodology.webp) how-it-works Friday, October 3rd 2025 ### [Mastering the Explore, Plan, Execute methodology for AI-assisted development](https://developer.upsun.com/posts/how-it-works/explore-plan-execute-methodology) Learn how to transform AI coding assistants from eager juniors into rockstar developers using proven context strategies, quality assurance, and the three-phase workflow ![How we cut AWS bandwidth costs 95% with dm-cache: fast local SSD caching for network storage](https://developer.upsun.com/images/posts/how-it-works/cut-aws-bandwidth-costs-95-with-dm-cache/cut-aws-bandwidth-costs-95-with-dm-cache.webp) how-it-works Tuesday, September 9th 2025 ### [How we cut AWS bandwidth costs 95% with dm-cache: fast local SSD caching for network storage](https://developer.upsun.com/posts/how-it-works/cut-aws-bandwidth-costs-95-with-dm-cache) Learn how Upsun solved costly inter-AZ bandwidth billing by implementing dm-cache with local SSDs, achieving 95% read traffic reduction and 30x performance improvement. ![High-performance backups: How Ceph snapshots enable incremental full backups](https://developer.upsun.com/images/posts/how-it-works/how-do-we-do-incremental-but-really-full-backups-on-top-of-ceph/ceph-backup-blob-storage.webp) how-it-works Monday, August 25th 2025 ### [High-performance backups: How Ceph snapshots enable incremental full backups](https://developer.upsun.com/posts/how-it-works/how-do-we-do-incremental-but-really-full-backups-on-top-of-ceph) Learn how Upsun leverages Ceph's RBD export-diff feature to implement high-performance incremental backups that maintain full restore capabilities for large-scale container storage. ![How Upsun built stateless mesh networking for high-density containers](https://developer.upsun.com/images/posts/how-it-works/how-upsun-built-stateless-mesh-networking-for-high-density-containers/mesh-network.webp) how-it-works Wednesday, August 6th 2025 ### [How Upsun built stateless mesh networking for high-density containers](https://developer.upsun.com/posts/how-it-works/how-upsun-built-stateless-mesh-networking-for-high-density-containers) Discover how Upsun's innovative stateless mesh networking architecture handles thousands of containers without databases or bottlenecks. ![Beyond Tool Calling: Understanding MCP's Three Core Interaction Types](https://developer.upsun.com/images/posts/how-it-works/mcp-interaction-types-article/mcp-interaction-types-article.webp) how-it-works Saturday, June 7th 2025 ### [Beyond Tool Calling: Understanding MCP's Three Core Interaction Types](https://developer.upsun.com/posts/how-it-works/mcp-interaction-types-article) Discover how prompts, resources, and tools work together in the Model Context Protocol to create richer AI application experiences beyond simple tool calling. ![How we host a Debian repository on AWS S3](https://developer.upsun.com/images/posts/how-it-works/debian-repo-s3/debian-logo.webp) how-it-works Wednesday, January 29th 2025 ### [How we host a Debian repository on AWS S3](https://developer.upsun.com/posts/how-it-works/debian-repo-s3) Pretty cool fact about our internal Debian repositories: they’re hosted entirely on AWS S3. Why is that cool? For 2 ![Using the Upsun API](https://developer.upsun.com/images/posts/how-it-works/using-the-upsun-api/red-background.webp) how-it-works Thursday, September 19th 2024 ### [Using the Upsun API](https://developer.upsun.com/posts/how-it-works/using-the-upsun-api) \> Anything you can do, API can do better! ![Semper vigilans: how Platform.sh stays ahead of emerging cybersecurity threats (so you don’t have to)](https://developer.upsun.com/images/posts/how-it-works/how-platformsh-stays-ahead-of-emerging-cybersecurity-threats/terrible_trio_blog.webp) how-it-works Friday, October 13th 2023 ### [Semper vigilans: how Platform.sh stays ahead of emerging cybersecurity threats (so you don’t have to)](https://developer.upsun.com/posts/how-it-works/how-platformsh-stays-ahead-of-emerging-cybersecurity-threats) Always vigilant is more than a motto. Find out how the Platform.sh Security team monitors vulnerabilities 24x7 to protect customers from cybersecurity threats. ![SSH certificates with Platform.sh](https://developer.upsun.com/images/posts/how-it-works/how-do-you-manage-ssh-keys-in-your-organization/how-do-you-manage-ssh-keys-in-your-organization.webp) how-it-works Wednesday, October 21st 2020 ### [SSH certificates with Platform.sh](https://developer.upsun.com/posts/how-it-works/how-do-you-manage-ssh-keys-in-your-organization) Learn how Platform.sh simplifies provisioning SSH certificates for secure and keyless SSH authentication, enhancing security and making compliance easier. ![Installers that don't suck](https://developer.upsun.com/images/posts/how-it-works/installers-that-dont-suck/installers-that-dont-suck.webp) how-it-works Wednesday, August 5th 2020 ### [Installers that don't suck](https://developer.upsun.com/posts/how-it-works/installers-that-dont-suck) Learn how to create cloud-friendly web application installers that account for cloud-based environments and optimize the user experience. ![The Platform.sh build-and-deploy pipeline](https://developer.upsun.com/images/posts/devcenter.webp) how-it-works Tuesday, October 3rd 2017 ### [The Platform.sh build-and-deploy pipeline](https://developer.upsun.com/posts/how-it-works/the-platformsh-build-and-deploy-pipeline) Learn how Platform.sh simplifies the build and deploy pipeline for web applications, ensuring consistency and repeatability with Git-based semantics. ![How repeatable deployments work](https://developer.upsun.com/images/posts/how-it-works/repeatable-deployments/how-repeatable-deployment-work-jpg.webp) how-it-works Tuesday, December 13th 2016 ### [How repeatable deployments work](https://developer.upsun.com/posts/how-it-works/repeatable-deployments) Platform.sh ensures predictable, repeatable deployments by controlling the key inputs to your application and guaranteeing code consistency. ![How the Platform.sh PaaS works](https://developer.upsun.com/images/posts/how-it-works/how-platform-paas-works/Blog_How_Platfromsh_Works.webp) how-it-works Tuesday, March 3rd 2015 ### [How the Platform.sh PaaS works](https://developer.upsun.com/posts/how-it-works/how-platform-paas-works) Discover how Platform.sh simplifies PaaS. Focus on your code; we manage the rest. Explore our second-generation PaaS for seamless application development. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.