1 of 26

WordPress�at Scale

go.epfl.ch/ wpatscale

Dominique Quatravaux�EPFL ISAS-FSD

FOSDEM’2026

École�polytechnique�fédérale�de Lausanne

EPFL ISAS-FSD

FOSDEM’26 — Containers track

2 of 26

EPFL�is�… BIG

2

  • 14’012 students
  • 372 academic staff
  • 6’530 employees
  • 130 home countries

… We have datacenters!

(… with VMs and NFS)

​

Our team: 8 employees, 5 interns

… for 26 apps (not just WordPress)

EPFL ISAS-FSD

FOSDEM’26 — Containers track

3 of 26

> Serving at Scale

Operating at scale

Developing at scale*

  • Kubernetes, containers, pods
  • php-fpm, nginx
  • Off-premise cache 😇

3

EPFL ISAS-FSD

FOSDEM’26 — Containers track

4 of 26

We’ll need… 865 WordPresses.

  • … 679 of which live under the same DNS domain, www.epfl.ch
    • Homepage
    • www.epfl.ch/labs/foolab (400×)
    • www.epfl.ch/campus/associations/bar�(60×)
    • …
  • inside.epfl.ch/department-baz (100×)
  • quuxconf2026.epfl.ch
  • …

4

EPFL ISAS-FSD

FOSDEM’26 — Containers track

5 of 26

Attempt #1 (~2019) =

WordPress of the 2000s

Designed and operated as a general-purpose LAMP hosting

  • Tenant uploads
    • WordPress (or whatever)
    • Theme(s)
    • Plug-in(s)
  • We kind of didn’t know any�better back then.

5

EPFL ISAS-FSD

FOSDEM’26 — Containers track

6 of 26

… Not really at scale.

6

  • Apache?
    • 1 request = 1 thread
    • Always costs full price (in RAM, threads)
  • PHP over NFS?
    • WordPress includes ~1000 PHP files as part of its hello-world code flow
    • Latency is at least 1000× the RTT to your filer
      • Cache?
      • … Doesn’t help —  revalidates with stat(2)

​

EPFL ISAS-FSD

FOSDEM’26 — Containers track

7 of 26

In 2025: do it again, do it right

7

EPFL ISAS-FSD

FOSDEM’26 — Containers track

8 of 26

Edge cache

  • It protecs!
  • It attacs serves captchas!
  • It pays for itself in sheer bandwidth savings!

(Disclaimer: not affiliated with Cloudflare in any way, besides being satisfied customers of their service)

8

EPFL ISAS-FSD

FOSDEM’26 — Containers track

9 of 26

9

… How many pods?

EPFL ISAS-FSD

FOSDEM’26 — Containers track

10 of 26

WordPress in a container two containers

  • Apache → nginx: non-blocking Web server
  • php-fpm: same pod, separate container
  • ships w/ immutable PHP code� 👍
    • Security: hard to backdoor
    • Performance: kernel FS cache� ≈ µs latency

We used to require another layer of cache on-premise (varnish). We no longer do.

10

EPFL ISAS-FSD

FOSDEM’26 — Containers track

11 of 26

nginx is boss 👑

  • knows 🧠�about all sites, all URLs, all filename patterns, and all WordPress 12-factored variables�(i.e. MariaDB credentials)
  • serves 🧑‍🍳�static files out of
    • The container image
    • or NFS again (just for uploads now 😉)
  • passes 🏈�the query to php-fpm for interactively rendered content

11

Each WordPress request is served independently from the others.

EPFL ISAS-FSD

FOSDEM’26 — Containers track

12 of 26

PHP?...

12

A design oversight turned killer feature:

forget everything, every time.

  • PHP / WordPress starts over from a blank slate upon each and every request.
  • Efficient? How?... 🤔
    • “shared memory”
    • “Zend cache”

​

EPFL ISAS-FSD

FOSDEM’26 — Containers track

13 of 26

PHP?...

13

We are effectively

​

turning the whole WordPress� into a function-as-a-service.�

EPFL ISAS-FSD

FOSDEM’26 — Containers track

14 of 26

Serving at scale

> Operating at Scale

Developing at scale*

  • Using Kubernetes to the best of its capabilities�
  • Absorbing complexity with the WordPress operator�

14

EPFL ISAS-FSD

FOSDEM’26 — Containers track

15 of 26

The operator is a program

  • … that operates in your stead.
  • In goes: 1× WordpressSite Kubernetes object
  • Out comes your site… kind of piecemeal:
    • 1× Ingress # of a “private” IngressClass; more on this later
    • 1× Route # or sometimes 0×, e.g. www
    • 1× Database # 🏈 to MariaDB operator
    • 1× mkdir() on NFS # uploads
    • Homemade PHP code that
      • Initializes the site
      • Initializes or reconciles plug-ins and themes

15

All of that is made

  • With Python and Kopf, the Kubernetes Operator Framework
  • In a fully EPFL-agnostic way! �→ #coreplugindesign

​

EPFL ISAS-FSD

FOSDEM’26 — Containers track

16 of 26

16

EPFL ISAS-FSD

FOSDEM’26 — Containers track

17 of 26

What needs doing on a daily basis?

17

Well… Not a whole lot.

​

  • We wrote wp-veritas (in Next.JS) for our Webgrandmaster to edit WordpressSite objects on their own
    • That app captures a lot of EPFL-specific “business logic”…
    • The rest being in our lineup of themes and plugins

EPFL ISAS-FSD

FOSDEM’26 — Containers track

18 of 26

What needs doing on a daily basis?

18

Well… Not a whole lot.

​

  • Backups to our on-premise S3 are being performed by the MariaDB operator
    • Our own WP operator can optionally restore a site from there, under the same URL or a new one

​

​

EPFL ISAS-FSD

FOSDEM’26 — Containers track

19 of 26

… nightly basis?

We moved wp-cron into its own Kubernetes CronJob.

(Solved the 22h22 problem.)

We use that to monitor “slow” metrics into a Prometheus pushgateway: → plugin

​

19

EPFL ISAS-FSD

FOSDEM’26 — Containers track

20 of 26

Developing at (some) Scale

There’s 13 of us... But we’d welcome more! 😉

20

EPFL ISAS-FSD

FOSDEM’26 — Containers track

21 of 26

wp-dev: jump right in!

  1. git clone https://github.com/epfl-si/wp-dev
  2. cd wp-dev; make up
  3. https://wordpress.localhost/ →

21

EPFL ISAS-FSD

FOSDEM’26 — Containers track

22 of 26

Conclusion:�Ready for immediate consumption?

WP-Operator

Dockerfiles

EPFL theme

Plug-ins: from� … to�

WP-dev

WP-Veritas�

22

e.g. pushgateway

Flagship contribution

Coupled with Ansible 🤷‍♂️

e.g. lunch menus

EPFL ISAS-FSD

FOSDEM’26 — Containers track

23 of 26

Thanks for attending!

​

… Please get in touch!

23

isas-fsd@groupes.epfl.ch

#2026-containers:fosdem.org

​

​

EPFL ISAS-FSD

FOSDEM’26 — Containers track

24 of 26

Future plans

  • Instrumented PHP → OTel
  • More documentation

24

EPFL ISAS-FSD

FOSDEM’26 — Containers track

25 of 26

The nginx ingress controller is another program

… that controls nginx, based on Ingress objects in Kubernetes.

  • In comes: a whole bunch of Ingresses, that the WordPress operator created (as seen previously);
  • Out comes: the nginx configuration file.

We took this one “as-is” from github.com/kubernetes/ingress-nginx (and substituted our own golang template)

​

25

EPFL ISAS-FSD

FOSDEM’26 — Containers track

26 of 26

Photo Credits

​

26

EPFL ISAS-FSD

FOSDEM’26 — Containers track