Quorum
Play

App Server

Runs your code. Answers requests and sends queries to the database.

What it does#

The App Server stands for a virtual machine that runs your code.

It takes every request kind. It answers page views and bots itself, and turns other kinds into backend calls: read and write queries, auth calls, tasks, charges, and more. Its capacity depends on its instance type, its runtime, and its framework. The tightest of four limits sets it: CPU, worker slots, memory, and network.

A request holds its worker slot while it waits on each backend call. So a slow Database also lowers the capacity of runtimes that hold a worker while they wait. This is Little's law.

The Garage box runs Postgres on the same machine. When you link it to a Database, Connection Pooler, or Cache, Postgres moves off the box for good. A Burstable box earns CPU credits while idle and is throttled when they run out.

When to place it#

Add a copy, or a size step, when its card shows CPU, workers, or memory near full and p99 climbs. Put a Load Balancer in front before the second copy. If the limit is workers while CPU is low, the box waits on its backends: fix those first. See Find the bottleneck.

How it fails#

Tips#

  • Match the instance family to the runtime: Compute for CPU-bound runtimes, Memory for many workers.

  • Restart a leaking server to free its memory. It comes back cold.

Rules#

  • Each further copy costs 25% more than the one before.
  • Selling it refunds 50% of what its last copy cost.
  • Its instance type sets its size and Burn. A size step doubles its resources and its Burn.
  • A new copy starts cold and is slow until it warms up.

Security#

These vulnerabilities can hit it. Patch them before the grace period ends.

  • CVE-2026-0451, CVSS 7.5
  • CVE-2026-0042, CVSS 5.3
  • CVE-2026-3141, CVSS 7.5
  • CVE-2026-1024, CVSS 9.9

Engineering terms#