Shipping a Commercial Web App in C via CGI in 2026
Original: A Modern Web App in C
Why This Matters
Shows CGI + C remains viable for production, challenging framework orthodoxy.
Developer Corey Prophitt built and shipped marketyour.games, a full commercial web product with accounts, payments, and email, using C, CGI, OpenBSD, and SQLite — no framework, no container, no JS required.
Prophitt's stack is BCHS: OpenBSD, C, httpd, and SQLite. There is no framework, no templating engine, no separate database server, and no container. Each HTTP request forks a fresh process running a statically linked binary. Deploying a new version means replacing one file — no restart, no downtime.
Three external libraries cover the essentials: libcurl for Stripe and Postmark API calls, libsodium for password hashing, random IDs, and webhook HMAC verification, and libcjson (a single C file) for JSON parsing. SQLite ships as its official single-file amalgamation. Both are vendored directly into the project. A clean build takes seconds; incremental rebuilds finish in under half a second.
All static assets are compiled into the binary and served from memory. OpenBSD's pledge and unveil syscall restrictions, plus httpd's default chroot, sandbox the CGI binary at the OS level.
Prophitt argues CGI's reputation as outdated doesn't hold up today. The CGI 1.1 spec was published in 2004 and has never changed — no API surface to learn beyond standard HTTP concepts. He also notes it resembles serverless architecture (a supervisor invokes code per request, passes environment variables, collects output) but without vendor lock-in. The minimal dependency surface is a deliberate security choice, given the rise of supply-chain attacks on package repositories.