AWS Lambda and .zip is a recipe for serverless success

https://medium.com/@PaulDJohnston/why-aws-lambda-and-zip-is-a-recipe-for-serverless-success-4f547a6e87c3

by kiyanwang • 8 years ago

146 111 8 years ago

mirceal• 8 years ago

Serverless has its upsides but it also has downsides.

In an ideal, pure, world it’s awesome. The problem is that your lambda function usually needs to use some sort of external resources. (It is pretty useless if you don’t interact with anything)

Now you have to worry about and understand how to do access control on the said resources, how to collect the logs, how to collect metrics relevant to your code, how do you troubleshoot and deploy the function itself, how do you integrate it with the rest of things you have/own.

You’re just shifting complexity from an area to a another area.

It works great in some cases, but it’s far from beeing a panacea.

_xnmw• 8 years ago

Right, and one of biggest downsides to serverless: reusing database connections/pools between requests. Right now the only "standard" solution offered by serverless's biggest advocates is pretty much a hack: rely on AWS's preservation of memory across some warm invocations. Basically keep it in a global variable and if you get lucky it'll still be there the next time your functions runs.

[1] http://blog.rowanudell.com/database-connections-in-lambda/

devonkim• 8 years ago

I think a mixture of persistent proxies could work well with lambda functions for this use case. You can run lambdas in your VPCs with assigned security groups and IAM roles just like an EC2 instance and therefore lambda functions should be able to proxy through an intermediate server that performs the connection pooling on behalf of calling functions. Not sure what the standard solution for something like this would be though because every time I've seen connection pooling it's for use locally. Perhaps some nginx or haproxy hacking could make it work.

paulddraper• 8 years ago

That's not really a "hack" though. Performance of lambda depends on warm processes, generally not just for connection pooling.

DB connection pooling is simpler in node.js + lambda than php + Apache.

gkoberger• 8 years ago

Hey! We built http://readme.build to solve these problems (logging, metrics, deploying, SDKs, etc). It's free currently, and I'd love feedback (greg@readme.io)!

alexcroox2• 8 years ago

I actually find zipping and uploading manually a PITA. Started using the Serverless framework [1] recently and now I just run `serverless deploy --stage dev --aws-profile profilename` from my repo (which is an npm script).

[1]https://serverless.com/

moondev• 8 years ago

No doubt! It seems antiquated and repetitive

dasil0032• 8 years ago

Well that's what CI/CD is for. It's not any different than building and pushing a new docker image.

mitchty• 8 years ago

It reminds me of WAR files with IBM websphere to be honest.

finaliteration• 8 years ago

It’s not quite as bad if you use .NET Core (which is what I’m currently using for a number of things in an integration stack). I just have to run “dotnet lambda deploy-function” with a template set up.

I started with Golang, however, and found the “out of the box” deployment process pretty painful which is part of why I switched to .NET Core.

marcc• 8 years ago

Uploading manually is a PITA. That’s because you really should automate it using CI/CD if it’s not your local dev environment. If you are manually uploading your code for a dev environment it would be worth exploring a better local, offline framework to avoid this. Don’t upload manually.

repsilat• 8 years ago

Why would you do it manually? Write a two-line script to do it. Downloading a framework to run an npm script that does the equivalent of running `zip` followed by `scp` (or `aws s3 cp` or whatever) seems crazy to me.

alexcroox2• 8 years ago

The framework handles the setup and management of versions and resources for me. Uploading is a small but relevant part of it.

paulgb2• 8 years ago

Another cool thing about Serverless is it can deploy a Python WSGI app (e.g. a Flask app) with little change in the code. It simplifies local testing and makes it easier to leave Lambda and move to dedicated hosting if I ever decide to.

Blackstone4• 8 years ago

When they do it for you it's awesome isn't it. I've been using Apex Up. It handles API Gateway config, the zip upload, SSL certs and deployment to AWS Lambda

idbehold• 8 years ago

You know what would be better than a .zip? A .tar.gz file. Zip files cannot be unzipped without having the whole thing in memory. What's funny is that the Lambda environments (at least for Node) do not have the `zip` executable available which means that to zip/unzip something inside Lambda I need one written in javascript which has to be included in the zip file I upload to AWS instead of being able to use the native one.

skybrian4• 8 years ago

You have it backwards. Zip files have a table of contents letting you unzip individual files without decompressing the whole thing, and you don't need to load it all into memory.

fulafel• 8 years ago

But this does not work for streaming since the directory is at the end. So you have to temporarily store the whole zip file.

sheetjs• 8 years ago

The table of contents in a zip file is at the end, not the beginning, so you need random access to the full file if you want to properly jump to the right location. Some zip files use the length feature of local file headers so you can jump ahead in the file without processing the data, but many skip the length so you have to work through the DEFLATE algorithm to find the end of the first file (to find where the second file starts)

FLUX-YOU• 8 years ago

.tar.gz sucks on Windows though (even 7-zip is a two step process).

userbinator• 8 years ago

Zip files cannot be unzipped without having the whole thing in memory.

Where/how did you come upon that piece of misinformation?

I can still remember using PKZIP to extract archives of over 100MB, on a machine with only 4MB of RAM, many years ago.

fapjacks4• 8 years ago

Cloud commoditized datacenters. People then tightly coupled their applications to cloud providers like AWS. After some time, containers came along and commoditized the cloud providers. Those applications no longer needed to be tightly coupled to a specific cloud provider. This reduced both costs and the risk of being invested in a single cloud provider.

Serverless (AWS Lambda) is just the cloud's way of trying to "de-commoditize" the containers that commoditized them. They want you to tightly couple your applications to their specific cloud provider again. And charge you more. How much is that function in the zip from S3 going to cost you to run in a container managed and run by AWS? And how long did you spend configuring the API Gateway (and where else can you apply what you've learned doing the configuration)? Next time you see an article fawning over serverless and saying things like "Containers just don’t matter in the serverless world" take a look at what the author does for a living. You'll start to see the same pattern I've been seeing.

Meanwhile, you could be spending less money and time treating AWS like a dumb processor with a network connection while only really configuring the open source software you already know. But it's your time and money.

dev1n3• 8 years ago

API Gateway is the literal manifestation of the worst product I have ever had the misfortune of configuring. This is mostly due to AWS's incompetence at delivering any semblance of working documentation around the product. Looking forward to their new "open source" documentation.

Shoothe• 8 years ago

I can second this. I wanted to write a simple provisioning tool a while ago that sets up HTTP endpoint on API Gateway and forwards the call to Lambda and the process was extremely complicated.

nzoschke3• 8 years ago

Check out the Serverless Application Model (SAM): https://github.com/awslabs/serverless-application-model

All of the manual configuration of API gateway vanishes because it builds up an implicit API gateway from your functions and event mapping config.

You can see a boilerplate SAM config here: https://github.com/nzoschke/gofaas/blob/master/template.yml

I'm hacking on CORS today and with SAM it's 2 lines of config to add the allowed origins and methods.

staticassertion2• 8 years ago

I just don't get the "lambda locks you in" thing. You write a server the same way you always would, but like an extra 50LOC exists to make it work on lambda. So if I wanted to deploy elsewhere what would the big deal be?

Lambda also provides a lot more than containerized services, as the article mentions - I no longer have to patch my system, which is a huge operational/ security burden that many companies struggle with. The time to configure API Gateway/ Lambda feels trivial compared to the work involved in maintaining a patched FAAS solution.

paulgb2• 8 years ago

I agree, but in my experience, the lock-in with using Lambda is that you become integrated with other Amazon services (like S3 and DynamoDB) that are harder to replace if you abandon AWS entirely.

electricEmu6• 8 years ago

Why functions over Docker or Elastic Beanstalk? There's more than one PaaS path.

On vendor lock-in, I'm moving between clouds now. Serverless did not translate well at all. We would have saved a ton of time, and frankly had an easier operational experience, if we went with Docker from be beginning.

"Ok Jill, next we need to determine how Azure Storage Account bucket calls differ from AWS S3. Oh, S3 doesn't have queues so we need to use SNS which changes the transaction model...Yeah, we've gotta handle different guarantees"

Product at most places "doesn't have the time" for developers to abstract the serverless hooks. You have to change the interface that runs your app instead.of the interface your app provides.

breatheoften2• 8 years ago

If anything — 50 LoC seems like it might even be an overestimate. I use a wrapper function around all my lambdas that deals with translating from the aws http headers to an application standard, asynchronously retrieves a config object, and converts promise based business logic to the aws callback format. The actual business logic is then written almost entirely in terms of the business domain. The wrapper is less than 50 lines and extremely easy to write. Making an equivalent wrapper for another cloud function provider would be easy ...

Someone thinking the need to adapt the input parameter format to achieve provider portability is by itself enough reason to add docker to the application stack is making a huge mistake in accessing the relative cost of these components ...

I don’t think deploying containers to different providers is anymore standard than the differences involved in deploying cloud functions to different providers so it’s not as if using docker would actually give a more uniform multi-provider deployment model ...

djhworld• 8 years ago

AWS Lambda itself isn't vendor lock in.

If you write your Lambda function to put the interaction between the AWS Lambda service at the surface level of your application (i.e. the entry/exit point), and then write your business logic inbetween, you can create a function that is quite easily tranferrable between cloud providers.

The vendor lock in creeps in more around the surrounding services that the cloud provider offers. You can protect yourself from this though by writing good quality hooks that have pluggable backends, e.g. writing/reading to an object store should be abstracted

electricEmu6• 8 years ago

Why would I split, write, and deploy an vendor cloud function for every cloud provider when Docker moves between them?

My team ditched serverless functions. We're better off without them.

nostalgeek• 8 years ago

AWS Lambda itself isn't vendor lock in.

Can I call my Postgres deployment on Azure via AWS lambda?

bthornbury3• 8 years ago

Might as well throw away the automobiles and go back to horses, they're cheaper on gas.

Forget that they take more time to care for, and to learn how to ride, and how to feed properly.

reactivesearch• 8 years ago

I think this is a bad analogy. Containers don't reduce convenience by a significant factor. On the other hand, what you are suggesting ...

ryanmarsh• 8 years ago

I don’t understand why people complain about Serverless vendor lock in.

Let’s split lock-in into two categories:

1. Essential complexity

DyanmoDB and Firebase are different products with different features and complexities. There is no “ANSI SQL” here. They are as different as they are similar. Moving from one to the other is a non-zero cost because they have different features your app would have to make up for or adopt.

2. Inessential complexity

Serverless functions don’t necessarily need different signatures and it is conceivable that a standard for HTTP evented functions could emerge. Many are working on this. I expect this to be largely resolved over the next few years.

Lastly, I’m grateful for ANSI SQL but over the last 20 years I think I’ve seen one or two clients migrate a mature Java app from one database vendor to another (excluding some very recent moves to AWS RDS). Keep in mind that JDBC is about as good an abstraction as we’ve ever had for database agnosticism.

When you choose to build a lot of complexity upon an abstraction you have to be honest with yourself: have you ever dealt with a service (storage, queues, naming, auth, etc...) that didn’t have leaky abstractions? Of those with few/zero leaky abstractions how often did you need to migrate to a different vendor? Why do we expect a rapidly evolving set of systems and services to behave like mature commodity software?

Fear of vendor lock-in is a premature optimization.

mankash666• 8 years ago

AWS and other managed FaaS offerings allow you to go from zero to endpoint in minutes.

You can choose to deploy your own open source Faas framework (like openwhisk or open-faas) on one of these clouds, but YOU will have to:

1. Manage scaling of underling EC2s

2. Manage security patching of both the docker and underlying OS

3. Setup whole lot of configs

4 manage optimizations

With a managed FaaS you're trading ops for more dev time, but someone has to be paid for the ops - it isn't free

ec109685• 8 years ago

Another issue with Lambda is that everything goes off the rails if you need to do something that Amazon hasn’t prioritized yet. Let’s say you want a GRPC endpoint, web sockets, http/2, mutual tls authentication, etc. Lambda won’t help you and you’ll be left building up your own patterns for those. Once you have those patterns, then Lambda’s use cases can be satisfied as well.

Also, Lambda doesn’t provide any sla’s on container reuse. They could restart your container multiple times per second or every few minutes. You are at their mercy to keep your containers warm.

Finally, with the meltdown example, would containers actually need to be patched if the parent OS gets patched since the kernels are shared between host and client containers? With Fargate, amazon would patch the base OS and your containers would be safe as they get rescheduled onto patched nodes.

manigandham• 8 years ago

Serverless is nothing more than PaaS - just at a more granular deployment/operation/billing/analytics scale. PaaS has always had a certain amount of lock-in because it's an abstraction, as any abstraction naturally does.

There are also some abstractions like Kubernetes that are neutral yet also managed with extras by all the providers which is a nice middle ground.

None of this is new or groundbreaking other than the silly hype words like "serverless".

gardnr• 8 years ago

I agree with you about the term "serverless" being silly, especially in a time when all the various forms of decentralized architecture are beginning to come of age. It makes it difficult to find information on "serverless webrtc signalling."

While other auto-scaling PaaS exist, the granularity of the lambda pricing model is fairly new and groundbreaking. A service can be launched that may see very little use and just costs pennies to test out during its initial phases. That same service will scale exponentially rather easily in comparison to a similar deployment on a traditional server.

cdnsteve• 8 years ago

I suggest you take a look at https://www.openfaas.com/

WhitneyLand• 8 years ago

Then what is the point of the open source serverless frameworks our there? Or are you making that argument only within the context of aws lambda?

justicezyx• 8 years ago

It’s a cycle Depending on where you start your argument, one can be the commodity or meta commodity Your point is sort of moot Cloud for next 10 to 20 years, is still about killing old it vendors and make people not worried to put everything they own on cloud. Container or serve less is but major milestones.

TAForObvReasons• 8 years ago

Does anyone have experience with alternatives to AWS Lambda (like azure functions)? How hard is it to switch between serverless providers?

faitswulff• 8 years ago

I played with Firebase (Google Cloud) Functions recently and the developer experience was pretty good. It's like if serverless (https://serverless.com/) had first party support, in the form of the Firebase CLI. Deploying was simple, the Firebase dashboard is nice. That said, I only used it for a side project, so I don't know about any pains scaling. I would definitely use it again for another side project, though.

bigtunacan• 8 years ago

I will second Firebase. It has really matured as a platform over the past couple of years and is a much easier service to work with than AWS.

As to the parent’s question on switching cloud providers though I think it would be non trivial.

bthornbury3• 8 years ago

www.coherenceapi.com

Makes the OP's scenario much easier. Code upload and configuration all handled for you. You run code online the same way you call a local function.

Disclaimer: I am the founder/dev/designer of CoherenceApi.

keithwhor• 8 years ago

Reading through this comment thread, if anybody is interested in a much more streamlined “serverless” experience and superior API Gateway, check out StdLib [1]. We’ve built a product for getting APIs built and shipped, full stop.

Bonus: .tar.gz format for submitting packages instead of .zip (though our CLI handles it automatically), and a bunch of freebies - everything from automatically generated documentation [2], SDKs, simple local development and testing, and more.

Disclaimer: Am founder.

Disclaimer 2: At the risk of being borderline spammy, we’re hiring aggressively. If you’re passionate about building a future that uses serverless technologies to make software development and APIs more accessible, e-mail me. (And thank you, pre-emptively.)

[1] https://stdlib.com/

[2] https://stdlib.com/@messagebird/lib/numbers/

appdrag• 8 years ago

Check also a more visual approach to Cloud Backend including an sql cloud database and an API builder : https://cloudbackend.appdrag.com

Disclosure: I'm founder

wrmsr• 8 years ago

It's just code in a .zip file! It's really that simple!

Hey, unrelated what does "cannot open shared object file" mean?

nzoschke3• 8 years ago

Deploying .zip files is one of my favorite features of Lambda, particularly when writing Go apps.

Docker always felt wrong with Go to me.

Why do I need a local VM, a Linux build service, an image registry and servers with container orchestration to deploy Go software? I understand how all this helps with "legacy" Rails or Java apps, but why can't I just throw a Go binary somewhere to run it?

Lambda is exactly this. I upload a cross-compiled .zip to S3 and everything else is taken care of. This was a big breakthrough for me, seeing a much simpler solution for deploys than all the container stuff.

I've been building a boilerplate app that demonstrates just how little "stuff" is needed to run a Go service on Lambda:

https://github.com/nzoschke/gofaas

More thoughts about how .zip files make our lives easier is here: https://github.com/nzoschke/gofaas/blob/master/docs/dev-pack...

mohaine• 8 years ago

Your go containers don't need anything more than your static binary, root certs, and tzinfo files. Everything else is extra.

nzoschke3• 8 years ago

Plus a base image, Docker build system, image registry service and Docker runtime.

Not to mention the load balancer and container orchestration to run the containers.

It's not all bad. Container tools and services are ubiquitous, pleasant to use, and support literally any workload you may have.

But throwing a zip in S3 and having API gateway send it requests is far less moving parts (at least that we have to worry about).

fapjacks4• 8 years ago

You don't need all of that shit, though. You absolutely can just throw a golang binary into a super minimal alpine image and run it wherever you've got a Docker daemon installed. You literally don't need any of the things you listed! Plus, it is simply untrue that "everything else is taken care of" in Lambda. There is plenty of one-off configuration to do ("toil").

subway• 8 years ago

If you're just working with a golang binary, you shouldn't be using an Alpine container, you should be putting the binary in an empty, from-scratch container. Go binaries are typically static and don't need distro or the libs it provides in their container.

jeffnappi• 8 years ago

It actually wouldn't be too hard to build a MacOS tool for building scratch Docker containers with a cross-compiled Go binary. The docker image format roughly just a tar file containing a manifest json file and a tar file containing the root filesystem. *

Sure Lambda is pretty simple (just upload a zip!) and is very similar to what Google AppEngine has been doing since 2008 (AppEngine also uses zip). But you are signing up for complete lock-in...

Also, it's depressing to note that MacOS is now the only major operating system that does not have support for native Linux containers without the use of a VM. * *

* https://github.com/moby/moby/blob/master/image/spec/v1.md

* * https://www.hanselman.com/blog/DockerAndLinuxContainersOnWin...

nine_k• 8 years ago

I keep being dazzled how what's basically "cloud CGI" is such a runaway success. Utter simplicity beats many considerations.

(For those who did not write web apps in 1990s: CGI here is https://en.wikipedia.org/wiki/Common_Gateway_Interface)

roywiggins• 8 years ago

It certainly does seem a throwback to old managed PHP environments. No need to set anything up, just provide your PHP code over FTP and off you go!

Zelphyr• 8 years ago

I agree with you in principal but AWS and Lambda feels significantly more complex than that. At least when I was FTP'ing my code up to some shared host I still had a lot of control over my environment (ini overrides, htaccess, etc...) With Lambda I feel like I have very little control. There is a black box running this stuff that I have no insight into. Even worse; when things break the resulting error is often unrelated to the actual problem.

not_kurt_godel• 8 years ago

Why is this a surprise? CGI is a great model for server programming. Lambda provides the same model packaged in a way that is enormously more convenient and powerful.

chapill• 8 years ago

I kept waiting for the author to say, "Surprise, it's a jar file. Jars are just zips, and lambda supports Java." Then I realized author really was reinventing wheels for the reader who probably doesn't know what Java is.

nudpiedo2• 8 years ago

I am totally with you... I think we are going backwards in technical choices just because some people had pain-points learning pre-existing technology or did not know how to deal with infrastructure. But if people pays for it, it is a market I guess.

byronmagnusson• 8 years ago

Bingo!

nudpiedo2• 8 years ago

I feel it is like reinventing executables, the dumb way.

We can compare that with ELF binaries or remote procedure calls when someone else maintains the OS and makes sure that the infrastructure scales. Actual not even executables, because it is still interpreted code, instead of being "compiled" it is packed and distributed with a spec much less precise than a typical platform. Just because someone has a machine ready to be deployed on and scale ad infinitum.

Am I the only one who finds that a dumb protocol for a remote call? Could someone point on which part is this a smart badass thing? Perhaps it is just a weird "renascence of Operating Systems"?

Edit: I still think that we got here because it was too much work to learn about pre-existing technology or hire an expert and it was more fashionable/easy/cool/sexy to kick ass and move on.

P.S. Sorry for this sudden rant

bamboozled• 8 years ago

I agree with this sentiment and feel the same way. I also find this is a frustrating trend in our industry in where a lot of engineers seem to be spending more time learning about "services" from specific vendors than about things like network protocols and their workings and limitations.

sedachv2• 8 years ago

Maybe this is just inevitable evolution of the IT industry but I've noticed two things that are alarming.

I was at the Southern California Linux Expo[1] earlier this month, and one of the really weird things was how many people from Microsoft were presenting and attending (I wasn't the only one - Bryan Lunduke, ex-MSFT, did a podcast episode about it[2]). I think the trends you point out are from a lot of Microsoft, IBM, Oracle, Java, etc people now being forced into the Linux world, because Linux is now the default for new IT projects. Unfortunately they are bringing along their "practices" instead of retraining in good software systems engineering.

[1] https://www.socallinuxexpo.org/scale/16x [2] http://lunduke.com/2018/03/10/microsoft-headlined-a-major-li...

sedachv2• 8 years ago

Perhaps it is just a weird "renascence of Operating Systems"?

"Serverless" really comes down to being a fancy inetd(8). The "new" part is all in proprietary software-as-a-service to automate server deployment, cluster management and configuration, network configuration, access control, and log collection. In the next technology cycle 6-10 years from now, people will realize that having so much of your software tied into proprietary software-as-a-service is an idea that is even worse than running on proprietary operating systems (NT, Netware, VMS) was in the 1990s.

I feel it is like reinventing executables, the dumb way.

Consider this: in the Unix philosophy, most executables consist of taking things that should be procedures and packaging them up as programs. "Serverless" is largely about applying the Unix philosophy to SaaS - "microservices." So now you are taking things that are really procedures, packaging them up as executables, then packaging those programs up as Internet servers.

I heard or read somewhere a quip that debugging this "stack" is something like the Russian fairytale about Кощей[1]: you have to find a needle, which is in an egg, which is in a duck, which is in a hare, which is in an iron chest, which is buried under an oak tree, which is on an island.

[1] https://en.wikipedia.org/wiki/Koschei

tracker12• 8 years ago

I use containers (Docker for Windows|Mac) to create my lambda zip for dist, isn't that close enough? lol.

jbrambleDC• 8 years ago

I actually do the same thing. Do the dependency install inside of a docker container in order to build the .zip. This is absolutely essential for compiled libraries in python or anything that involves postgresql. If you attempt to install psycopg on mac and then deploy that on lambda it will fail. So you either need a prebuilt version for ubuntu that you keep around, or you need to build in a docker container. We just build inside a docker container.

tracker12• 8 years ago

Yeah, it works really well, also allows me to configure CI/CD in VSTS/TFS via Windows agents for AWS deploys to Lambda. In the end, I'm pretty pleased with it. I've mostly used Node, but Python binary dependencies would have the same need.

Not entirely sure why I got the downvote, other than the tongue in cheek aspect and "lol" at the end.

bahmboo• 8 years ago

Don't think that building your whole service on lambda or google cloud functions with tons of code is the best idea, but it's a great shim between clients and backends. Tech changes constantly and you'll always be up against a change agent. Be nimble.

TheDong• 8 years ago

The comment about meltdown is wrong.

You had to patch your containers and your instances/servers, but you didn’t have to patch Lambda functions.

This was right after talking about Fargate. Let's compare what you do and don't have to patch in Fargate / Lambda:

Kernel / host OS: Lambda and Fargate patch that for you without any work. This is the more important patch.

Container bins/libraries: some programs, like Chrome, which had JIT, could be exploited to read memory of that same process. In the case of lambda and fargate, you only needed to patch containers/zips that contained such programs.

If you were using something like 'serverless-chrome'[0] in lambda, you would have to update your zip file to get Chrome's workaround for meltdown. If you had a fargate container with headless chrome, same deal. It's practically identical in the cited case of meltdown.

There are many cases (like glibc or openssl vulnerabilities) where containers need to be patched, but lambda can patch it for you ... but in the case of kernel exploits, fargate and lambda can patch equally well.

[0] https://github.com/adieuadieu/serverless-chrome

themihai• 8 years ago

IMHO Cloud functions serve well a very small niche. However most of the people advocating for cloud functions seem to misused them. Their use cases would be better served using a well designed PaaS(though I admit is hard to find a good one these days).

AWS Lambda and .zip is a recipe for serverless success

Related Stories