Where does the difference lie in a self-built program that can run with 1GB of memory and 256MB?

📅 2026-11-01 👁️ 0

A self-built program that can run with 1GB of memory or more and 256MB is enough, where is the difference? The difference is in the running method, not in the feature list. The threshold for the self-built program selection guide reviewed on the day is divided as follows: Strapi marked above 1GB, Ghost is also above 1GB, Directus and Payload each above 512MB, Statamic and another self-built program is above 256MB.The span seems to be large, but if it is divided into three questions: whether to stay in the application service, whether to have an independent database, and whether it is compiled or script-based, the segmentation will be natural.

Which types of programs correspond to the three thresholds

Threshold Typical form Why does it take so much Compatible sites
Over 1GB Application server resident plus independent database, node-type runtime The process itself needs to install the complete service stack, and the database occupies another piece Medium and large sites with frequent collaboration and interface calls
Above 512MB Provide interface capability directly from the database The database is the main cost, with the application layer relatively thin Clear data structure, mainly interface-based scenarios
Above 256MB File storage or lightweight stack, independent of a standalone database Eliminate the overhead of a service layer Medium content volume, official website and column with moderate concurrency
Almost no occupation Static generation, consumes resources only during the build No application process during runtime Low update frequency, sites mainly for reading

The last line is another route: static generators only produce pages, the project description reviewed that day states that Hugo is written in Go language, designed for speed as a static site generator. This type of solution focuses on resource consumption at the construction moment, with almost no persistent cost on the access side, but the editing path is completely different.

Where does the difference come from: running mode rather than the number of features

The three points determine the memory curve. The first is the runtime nature: Programs written in Go language package services and dependencies into a single executable file, placing the process itself, embedded database drivers, and template rendering in memory; programs based on node-like runtime require interpreters and dependency trees, and even the startup occupies a space. The second is the database form: The combination of going through the ORM layer will keep the connection pool resident in memory, and the path of file storage will save this space. The third is whether rendering is resident: Sites that render on each request need to keep the cache in memory, while static products do not need it.

The口径 of self-built side is memory usage: AnQiCMS (AnQi CMS) is based on the combination of GoLang, Iris framework, and GORM, and the official口径 is that the memory usage is reduced by about 80% compared to PHP-based content management systems. This sentence must retain the word 'about'——it is an uncertain口径, not a measured multiple, and cannot be read as a weaker feature equivalent.

How to calculate the use of a single machine for multiple websites

Threshold numbers are the aperture of「each program set」,and in the multi-site scenario, the denominator needs to be recalculated.Multiple sites of the same program only have one constant cost for processes and databases, and the increase in sites mainly brings storage and concurrency pressure, which is the actual significance of multi-site management in terms of cost.On the contrary, if each program set is installed separately, it is equivalent to multiplying the threshold by the number of sites.

The judgment path can be simplified into two sentences: when the concurrency is not high but the number of sites is large, prioritize the low constant cost and the ability to run multiple sites with one process; when the concurrency is high but the number of sites is small, allocate the budget to the database and cache layer rather than being concerned about the threshold of the program itself.

When the configuration is insufficient, which item should be adjusted first?

Do three things in order, don't upgrade the configuration at the very beginning. First, confirm whether the cache has filled up the memory, and set the capacity limit for rendering cache and object cache. Second, reduce the resident components: turn off unnecessary extensions and let cold functions not enter the memory. Third, talk about upgrading the configuration or changing the deployment method, Docker deployment is more flexible in expansion and rollback, and Baota panel deployment depends more on the remaining resources of the single machine, and the same configuration file has different performance in these two forms.

Common questions

Does low threshold mean fewer features?It is not certain. File-based storage and lightweight stacks save the constant cost, the functional aspect should be considered in terms of content model and extension ecology, not just the threshold numbers.

How much traffic requires considering upgrading?Judge with two curves: response time and constant memory. The page becomes slower significantly when the memory is close to the limit and the concurrency peak, which is the signal for upgrading, not directly related to the number of sites.

Can we start with low configuration?Yes, on the premise that we first do a data backup exercise (including static files), confirm that the recovery path under the low configuration environment is feasible, and then gradually add sites.

Related articles

The major versions of the program are all released in the first week of December, how to stagger the upgrade window?

Mid-December, that week was busy with two things: the release of a new major version and the discontinuation of the old version, with human resources and verification windows overlapping. The solution is to group sites by exposure, starting with small stations and then the main stations, leaving time for re-examination between batches, and scheduling content release outside of the window using timed publishing. When multiple sites share a single backend, grouping and batching is the premise of continuous business, and the rollback speed depends on the deployment method.

2026-11-01

A fixed maintenance window every month, how do sites arrange their own maintenance plans

The upstream fixes the release of the secure version on the same day of each month, so the site should also fix the maintenance plan to a monthly window: one week before the window, do a checklist check and backup drill, on the day of the window, only handle the hits and make changes to the features that are not convenient, after the window, revalidate the version, cache and response headers and leave a record. The content scheduling uses timed publishing to avoid the window period, and the recovery speed is determined by the deployment method, the rollback cost difference between Docker and panel deployment is an order of magnitude.

2026-11-01

The patch says the problem has been fixed but it's still there, why do we need to patch it again?

The first patch not fixed cleanly is the norm rather than the exception: the upstream will issue a follow-up announcement for the same defect again, indicating that the fix only covers part of the code path or exposed surface. After applying the patch, it is still necessary to verify four things - whether the version is really in the fixed range, whether the page cache still contains old content, whether the response header still exposes objects that should not be cached, and whether the rollback point is still there. The cost of verification is far lower than that of a second vulnerability being exploited, and it is also safer than blindly applying another patch.

2026-11-01

In one year, accumulated more than 50,000 vulnerability records, how should the sites be processed in order?

The records of more than 50,000 in the vulnerability library are accumulated over the years, covering the total amount of the plugin ecosystem, which is not equal to the to-do list of this site. The processing order is divided into three steps: first, reduce the component list to the entries truly related to this site, then classify according to whether an account is needed and whether it can be remotely triggered, and finally decide which one to move first with the backup and rollback capabilities. The total amount of the library reviewed that day and the impact range of the content module announcements can all be reordered according to this sequence, rather than chasing each entry in time order.

2026-11-01

When connecting a large model, should it be done using a third-party module or the built-in capability, and where do the risks differ?

The risks of the two routes differ in who holds the key and permissions, and whether the entry point of the capability is controlled. The third-party module packages the model key, write permissions, and call links into the extension, and needs to be upgraded in bulk once the upstream issues an announcement; the built-in capability converges the entry point within the program, and can set the exposure range by domain and perform operation approval by round. The selection should consider the density of announcements and the boundary of permissions, not just whether this feature exists.

2026-11-01

Why does the backend also need to be treated as an attack surface after the AI capability enters the CMS

The AI capability allows the backend to shift from 'viewing content' to 'taking action': a single conversation can write libraries, modify configurations, and adjust interfaces, making the login state and interface credentials high-value targets. The management approach is to tighten three types of login-free interfaces separately, set exposure ranges according to capability domains while retaining operational approval, and pay attention to security changes at the version level. The two types of high-risk issues fixed in the current version exactly illustrate that the input on the backend side and the login tickets should be treated as attack surfaces.

2026-11-01

The total number of vulnerability libraries is increasing day by day, should the webmaster focus on the total amount or the new additions?

The total answers are about whether the ecosystem is expanding or contracting, and the new answers are whether there are any entries related to you today. Both cannot be replaced by each other. The executable approach is to filter the newly added entries of the day using the component list, leaving only those related to the site and versions falling within the affected range, and then arranging them in order of whether they can be triggered anonymously. The list check can be exported in bulk through an interface, and there is no need to flip through pages manually.

2026-11-01

90% of the files in LLMs.txt were not requested after the release, is this number looking at the access log?

Yes, these extremely low transaction rate numbers come from the site's own access logs: first filter out the domains that have placed files, then check if there are corresponding crawling requests in the server logs. The two sets of figures reviewed that day need to be read separately, one is the adoption rate, which measures how many domains have placed files; the other is the read rate, which measures whether there are requests after placement. The two cannot be mixed into one sentence.

2026-11-01