nginx unix socket weirdness on Contabo

So I got this stack running clean on my home pop, latency is 4, cache hit on every reload. Same config pushed to Contabo and it's 340, full miss on static assets. Origin feels bad man.

The nginx config is identical, I even rsynced the whole thing. On test: upstream connects, no drama. On Contabo: connection reset by peer in error log, but only on unix sockets. TCP ports work fine. It's 12 now, was 8 this morning.

Anyone else seeing socket weirdness on their edge? I need to pop this into production by Friday but the origin is screaming at me.

To be precise, I have observed similar behavior on providers who deploy custom netfilter modules for traffic accounting or "security" purposes, which in my opinion raises GDPR concerns regarding data processing without adequate transparency.

The fact that TCP functions while unix sockets fail is highly specific. Have you checked dmesg for module loading events? I would request from Contabo a complete list of active kernel modules as far as I know they are obligated to disclose processing mechanisms affecting your data.

To be precise, the socket filter hook in their custom module is likely dropping packets it misclassifies as malformed.

I had same on OVHcloud last year, server down for 2 days than they admit custom kernel module

My fix was switch to TCP, unix socket never worked again on that host, they wont fix it than you wait weeks

Random Fact: Contabo and Hetzner same parent company, both use similar modules

Contabo €4/mo deal from last month?? I SNAPPED IT UP but haven't deployed yet

If custom kernel breaks sockets thats a dealbreaker, I need unix socket for my php setup

€4/mo ARE YOU KIDDING but not worth it if edge is broken

Anyone got refund data points on this? 🏃

The ticket said... "our enhanced security layer protects all customers by inspecting socket traffic for anomalies"

I once got an abuse report for "excessive loopback connection volume" on a host with similar module. The ticket said my own application talking to itself was "suspicious lateral movement." Took 4 days to escalate past first-line.

Contabo's module is called fm_shield as far as I've seen in leaked changelogs. It hooks socket_create and applies heuristics that break fastcgi upstreams specifically.