Web Servers

Gunicorn is a pre-fork server: one process manages a pool of worker processes. It's built for Unix. With its default sync workers, your proxy must buffer slow clients, or Gunicorn is open to denial-of-service attacks. Start with (2 × CPU cores) + 1 workers and adjust under load. For long blocking calls, streaming, or WebSockets, switch to async workers like gevent.

Uvicorn is an ASGI web server. In production, run it under a process manager. Its built-in one starts workers with --workers and restarts any that die, and its docs also cover running Uvicorn workers under Gunicorn. In a container, run a single Uvicorn process and let your orchestrator scale the number of containers.

Granian is a Rust HTTP server that serves ASGI, WSGI, and RSGI apps from one package. Its README suggests it when you care about throughput above all, and not when you want pure Python or your app relies on Trio or gevent. Pass --interface asgi or --interface wsgi, since the default is RSGI. Start with one worker per CPU core, or one per container on Docker or Kubernetes, rather than numbers suggested for other servers.

Hypercorn is an ASGI server inspired by Gunicorn. It speaks HTTP/1 and HTTP/2, with WebSockets over both, and runs on Trio as well as asyncio. For HTTP/3, install its h3 extra. Its docs recommend setting server_names to the hosts you serve, to block DNS rebinding attacks.

Waitress is a pure-Python WSGI server with no dependencies outside the standard library, and it runs on both Unix and Windows. Waitress doesn't support TLS itself, so put a reverse proxy in front of it for HTTPS.

Put a proxy like Nginx in front: Gunicorn's docs strongly recommend it, and Uvicorn's recommend it for resilience. Behind a proxy, tell your server which proxies to trust for X-Forwarded-* headers, since any client can set them. Uvicorn and Gunicorn take --forwarded-allow-ips, Granian trusted_hosts, Hypercorn ProxyFixMiddleware, and Waitress trusted_proxy. In Uvicorn, Gunicorn, Granian, and Waitress, trust every address with * only when no client can reach the server directly.