Given Tornado's single threaded design, a production service should run multiple instances of Tornado behind a proxy.<p>Upstart does not help with the multiple instance problem. Upstart adds the problem of running code with elevated privilege.<p>I think it might be simpler to write a script to start/stop/restart daemon Tornado instances running in an unprivileged account.