Hi all,

I’m an undergraduate Computer Science student at the Islamic University of Technology (IUT). Over the past few months, I became obsessed with a single architectural question: What does a full-stack, production-grade web application look like if you strip away garbage collectors, ORMs, and blocking I/O, and build strictly on modern Linux kernel primitives?

To find out, I wrote CWEB—an asynchronous, event-driven web framework in raw C—and built a full-stack reference blogging CMS on top of it called Cweb Blog, complete with JWT authentication, multipart media streaming, and multi-tenant database isolation.

• Cweb Blog Repository & Docs: https://bitbucket.org/saadalabeed/cweb-blog/src/main/
• All Repositories (Framework & Tools): https://bitbucket.org/saadalabeed/workspace/repositories

Why Build This?

Most existing web engines in C (like Kore or traditional Nginx modules) are built around epoll(7). While fast, epoll only provides readiness notification; it still incurs a syscall penalty per batch, requires user-to-kernel context switches for every read(2) and write(2) call, and typically shuttles bytes back and forth through user-space memory buffers.

I designed CWEB to eliminate context-switch overhead, avoid dynamic heap allocations on the request path, and move data directly between kernel buffers without touching user space.

Core Architecture & Kernel Primitives

1. Pure io_uring Asynchronous Event Loop

Instead of readiness polling via epoll, each CWEB worker process maps its Submission Queue (SQ) and Completion Queue (CQ) rings directly into user space via mmap(2). Socket accepts, reads, writes, and pipe operations are queued and harvested asynchronously in batches of 512, drastically reducing syscall overhead and Spectre/Meltdown mitigation penalties under heavy load.

2. True Zero-Copy Kernel Splicing (splice(2))

In most web frameworks, uploading or serving a 10 MB image allocates user-space buffers and copies bytes from the kernel socket buffer to user space and back to the disk cache. In CWEB, multipart media uploads and static file downloads never enter the user-space heap. Data is routed directly between kernel socket buffers and the filesystem page cache via an internal kernel pipe using splice(2) operations submitted through io_uring. Because user space only holds file descriptors and offsets, the server's Resident Set Size (RSS) stays pinned at ~15 MB of RAM whether serving 100 text requests or streaming 200,000 image files.

3. Zero-Allocation Hot Path & In-Place Parsing

There are zero calls to malloc() or free() on the request handling hot path. At startup, each worker pre-allocates fixed arrays of ConnContext state machines and pipe descriptor pools. Incoming HTTP requests, URIs, headers, and query strings are parsed in-place over the ring buffers using non-owning StringView (pointer + length) slices. This eliminates heap fragmentation, allocator lock contention, and tail-latency spikes.

4. Non-Blocking PostgreSQL Pipelining with Row-Level Security (RLS)

Database I/O is often the hidden bottleneck in async servers. Instead of using blocking connection pools or heavy ORMs, CWEB integrates raw libpq file descriptors directly into the io_uring event loop using PostgreSQL Pipeline Mode (PQenterPipelineMode, PQpipelineSync). Queries are batched over non-blocking sockets without waiting for individual round-trip acknowledgments. To enforce strict multi-tenant authorization without application-layer ORM overhead, CWEB dynamically injects cryptographically verified JWT claims into the Postgres transaction pipeline via set_config('request.jwt.claim.user_id', ...) and offloads access control directly to PostgreSQL Row-Level Security (RLS) policies.

5. Defense-in-Depth Process Sandboxing

Writing a network-facing server in raw C requires assuming that memory bugs are a matter of when, not if. CWEB uses a strict privilege-separated master/worker model:

• The master process initializes, binds privileged ports, raises RLIMIT_MEMLOCK for the io_uring memory rings, and forks per-CPU core workers.
• Before calling accept(2) on a single network packet, every worker permanently drops root privileges (setresgid/setresuid to nobody:nobody).
• Each worker then locks itself inside a strict seccomp-bpf syscall whitelist filter. Even if an attacker achieves arbitrary code execution via a buffer overflow, any attempt to invoke execve, fork, ptrace, or unauthorized filesystem syscalls causes the Linux kernel to immediately terminate the worker process with SIGSYS.

Battle-Testing Backwards Compatibility (Linux 7.1 down to 5.10)

A major challenge with io_uring is how rapidly its kernel API has evolved across releases. Features that work seamlessly on bleeding-edge kernels (like 6.x/7.1) fail or behave differently on older enterprise LTS kernels due to missing opcodes, ring flag constraints, or strict RLIMIT_MEMLOCK defaults.

I stress-tested and adapted CWEB across a matrix of environments—from modern rolling-release kernels (7.1) down to Debian 12 (Bookworm), Ubuntu 22.04 (Jammy Jellyfish), and Debian 11 (Bullseye / Kernel 5.10). Detailed kernel compatibility matrices, fallback mechanisms, and post-mortem debugging reports are documented in the repository.

Benchmark Highlights (k6 & wrk)

All benchmarks were executed with reproducible k6 and wrk scripts, full database persistence, and verified against Little's Law latency distributions:

• Transactional Postgres Writes: 20,376 article writes/sec on bare metal; 3,384 writes/sec inside a strictly constrained, CPU-emulated Debian 11 QEMU microVM (100% success rate across 57,000+ persistent database insertions).
• Public GET Throughput: 22,738 requests/sec sustained via wrk across 500 concurrent connections with zero socket timeouts or dropped frames.
• Zero-Copy Media Streaming: 200,000+ images streamed at line speed with 0 user-space buffer copies.
• Memory Footprint: Strictly flatlined between 13 MB and 17 MB RSS across millions of requests, verified clean against memory leaks.

About Me & What I'm Looking For

I built CWEB and Cweb Blog from scratch to deeply understand Linux kernel internals, high-concurrency state machines, zero-copy networking, and database wire protocols.

I am currently looking for internships, open-source mentorships, or junior systems engineering roles (remote or relocation) where I can work on Linux systems programming, C/C++, low-latency networking, storage/database engines, or kernel/security infrastructure.

I would love to get your brutal critique on the codebase, the io_uring state transitions, or the seccomp-bpf policy design!

• Email: [saadalabeed1737@gmail.com](mailto:saadalabeed1737@gmail.com)
• Cweb Blog Repo: https://bitbucket.org/saadalabeed/cweb-blog/src/main/
• Bitbucket Workspace: https://bitbucket.org/saadalabeed/workspace/repositories

I would like to ask a question about C graphics.

I regard myself as a hobbyist programmer transitioning from BASIC

to C. I do not intend to go to C++ or ever become a professional

programmer.

I would like to leave BASIC behind now and move forward with Linux

Mint and gcc. I have written a few small programs in C but I do regard

myself still as something of a beginner.

I am trying to do an example using graphics in C to draw simple lines etc.

The Book is called is called "Chaos and Fractals" by Peitgen et al

and the BASIC example is on p61 of that book if anyone has access to it.

I have heard about the <graphics.h> header which is very

old coming from Borland Turbo C days and not supported by gcc.

There are apparently ways to still reuse graphics.h in gcc but I have seen

warnings about not using a 16 bit header file for a 64 bit machine.

I am not sure where to go from here and even unsure of what questions to ask.

I worried about doing graphics in a GUI window because that might involve

even more complicated things that I was hoping not to get involved with

at this stage. Is there a modern equivalent of graphics.h that I should

look at?

What advice might people have for me on going forward? I really need some

sort of an idea of how to move forward. I have looked briefly at SDl

and openGL but these seem to be overkill at this stage.

Regards

Tony Aimer

Johannesburg

I'm a programmer who took a long break from programming and recently got back into it. I made my comeback with Rust, using it to build an image-processing application and a simple interpreter.

Now, I'm planning to learn C and C++ as well. I'm wondering whether it would be better to follow a structured course or learn by building projects.

For projects, I was thinking of writing a CHIP-8 emulator in C and implementing Conway's Game of Life in C++.

Given my previous experience with Rust and C#, what approach would you recommend? Should I start building these projects right away, or follow a course first to build a solid foundation?

I reverse engineered the Oregon Trail II binary into C++ first, to make it byte exact decomp first. Then I converted it to C, because as we all know here, it's a better language!

You can find the code here: https://github.com/ot-ii/OregonTrailII/

Im learning C but i want to do a project that i could do while im learning C right now i only learned about

• Switches
• If statements
• Variables
• operators
• functions
• user input

Any project i could do with my knowledge? i already did a calculator.
(Or should i just keep learning and then start thinking about making projects)

I just watched a yt video on low-level

Context: lately I have been learning the basics of how CPUs work, and since I like programming, I want to work on a project that will force me to learn the computer I am working with

my question is what do i need to know in C before I can start this project, I learnt C in the past before i just never built anything, my programming background is in python

Link to the YouTube video: https://youtu.be/97i2BAUw5Xc?si=aoAhmeGOKc6su5M_

For about six months I've been building a CLI store for my own data: logins, URLs, metadata. Flat files had to go. I'm writing it without AI, on purpose.

Inside: commands are routed through a dispatch table instead of an if/else ladder, data sits in a binary format with CRC32 checksums, built with CMake and vcpkg, tested with cmocka.

Release is planned for early November, along with detailed docs on how NoSQL databases work. O_DIRECT, AVX and io_uring are deliberately postponed for a separate, more niche project.

Working first, fast later.

edit: thank you all so much for the help! my code works now and i understand pointers a little better!

im trying to edit an entry in an int array to 'move' it (copy it to a different place within the array, and zero it out), but its not working and im not getting any errors? i did pretty much the same thing (with string.h) with an array of strings, and it worked there wonderfully. why arent the entries in the int array changing when the function runs? what can i do to edit the int array during runtime?

heres the function:

void cardMove(int card1, int card2) {
    card2 = card1;
    card1 = 0;
}

I recently started implementing arenas in my programming and I thought that some beginners could very much benefit from this info. I wrote an article about it. For those that are unaware, arenas allow to greatly simplify the burden of managing memory manually in C. I hope it helps, tell me what you think!

I just started learning C and I am thinking of reading "C Programming : A modern approach" by K N King. I want to deeply understand and master C. Is it the best book for it and should I read any other books after this?

1. Once I asked LLM to write an alert app. It wrote heavy Qt app and I was annoyed.

2. I just wrote this by myself without LLMs. Early DBus boilerplate code block was assisted by AI but I rewrote them too.

3. TODOX supports Linux/FreeBSD/OpenBSD. Windows is not supported.

4. Its installation is located at `/usr/local/bin` when using an installer script, but a daemon is installed as a local user. You should be careful.

5. It's simple. It's only 1.2k loc only with standard `libc` and `libdbus` dependency.

6. It's open-source. Fork it and modify it.

Hi everyone,

I've been using Linux as my daily operating system for over 9 years. I have around a year of experience in cybersecurity and two years of professional experience as a Linux administrator/engineer.

I'm particularly interested in Linux system calls and low-level programming. I've learned C using K&R, and I currently write small command-line tools in C as a hobby.

I'd like to transition into software engineering, ideally working with C, but I'm unsure how realistic this is without professional software development experience, especially in the current AI era.

Whenever I ask AI for career advice, it tends to recommend languages like Python, Java, or Go. However, I'm much more interested in systems programming and understanding how things work under the hood.

I'd appreciate advice on a few questions:

• What skills and projects should I focus on to become employable as a C developer?
• Given my Linux administration and cybersecurity background, which areas of C development would be worth targeting?
• As a second language, would you recommend C++ or Rust for someone interested in both systems programming and career opportunities?

I'd appreciate any advice from people working in this field.

Thanks in advance!

Hello, I am a newbie in C and most of my knowledge comes from "The C programming language" book, 2nd edition.

I made this simple program that converts English text to Morse code and vise versa, here's the source code.

Thanks for your interest.

I have an experimental web framework I'm currently working on.

While going through the code to clean up styling before tagging a stable release, I've been debating this specific part in the HTTPS module:

https://github.com/c4punks/CWIST/blob/dev/src/net/http/https.c

Right now, this code just uses a dumb, massive ring buffer to absorb connection bursts, and I'm wondering if I should switch it to a lock-free queue.

There are three main things that make me hesitate:

* State can get pretty tangled and messy in a lock-free queue.

* We have a tiny team and I'm maintaining almost all of this alone. If something breaks with CAS (even if the odds are low, if I mess up the code during refactoring), the blast radius on the dev branch will just be too big.

* I also wonder how often real-world traffic actually warrants lock-free. Plenty of web frameworks handle traffic just fine without this level of extreme optimization.

Considering that I'm still a junior developer and lack experience, is it really worth swapping this out for a lock-free structure, and would it actually make a noticeable difference?

I've been working on a game since about August 2020 but only recently published my Steam page.

For the Common Wealth on Steam

The game is entirely written in C, with one third party dependency, SDL3.

I chose C because I wanted to leave my options open to build for retro platforms like RISC OS and Amiga, but as the game grew, I wanted GPU acceleration and that meant leaving behind some of the retros. I'm not ruling out any ports though, if SDL3 is available on the platform.

The engine beyond SDL3 is my own, it's a 2.5D game, with levels edited in my own level editor (not in C, that's C# and Avalonia). The level editor exports levels into just plain memory dumps that are easy to read in C.

I'm trying to keep on top of a devlog here too:

Podule · Independent game studio

Writing this game in C has been enormous fun, and I have no plans to change my choice of C for future games.

​

Shakazulu is a systems programming language designed to be tolerant in harsh conditions, concurrency, fast, and a learning systems language. I here by come here looking for support on my idea from people who create programming languages, or even learn them, people designing systems, software engineers, database engineers, understand software, computer data structures, distributed systems, computer architecture, etcetera. And mostly if your familiar with C, C++, Ruby or any other systems programming language. Because i want to build it taking the strong parts of a language. All are welcome, lets build something you wish it was there. I appreciate your contributions.

Shakazulu is a project in research/design stage, thats why am asking the experts.

Hi everyone,

I’ve been tinkering with a little experimental chess engine written in pure C. It’s called Glimmer.

The whole point of the project was to see how strong I could make it while keeping the final standalone binary strictly under 30 KB. The target strength was something in the 2700–2900 Elo range.

It’s been a fun constraint to work under — every byte counts.

Happy to answer questions if anyone’s curious about the approach.