The Day Forty Thousand People Knocked

The Day Forty Thousand People Knocked

Forty Thousand People, One Door

Maya Patel had exactly four minutes of fame before her server died.

She was sitting on her bedroom floor, half-buried under a duffel bag and a stack of winter jackets she'd been ignoring for two months, when the first ping hit her laptop. Then the second. Then, somewhere between the second and the third, the numbers stopped behaving like pings and started behaving like rainfall on a tin roof. Her browser tab — the one quietly monitoring her little hobby app called SoundSplash — went from showing a flat, calm line of two requests per second to a red cliff. The y-axis literally broke. The little green dot that meant "server happy" turned yellow, then orange, then a color she didn't have a name for. She clicked over to the dashboard tab she'd built for fun, the one that just said how many people were listening, and watched the counter leap: 47, 318, 902, 4,021, 11,455...

By the time it hit 12,000, her laptop fan had woken up in a way it never had before, the kind of awake that sounded like a small rocket preparing for launch. The whole machine got hot under her wrists. The music playing through the app — the demo loop she'd set up for her school's battle of the bands — turned into a stuttering, broken record.

Maya was sixteen. She'd been coding for two years. She knew what an error message meant. She did not yet know what was about to happen next.

Across the hall, in the room with the *Star Wars* posters and the tangle of HDMI cables, her thirteen-year-old brother Devan was sitting very still, watching the same counter on his phone, his face cycling through delight, confusion, and a slow, dawning horror. He knew exactly what he'd done. About ninety minutes earlier, while Maya was at track practice, he'd opened her laptop (he knew her password — it was his birthday, which Maya would have disputed if she'd known), navigated to her GitHub, copied the link to SoundSplash, and tweeted it: *"my sister made this for our school battle of the bands, it lets bands stream their tryouts. it's actually insane."* Then he'd added a self-conscious emoji and put the phone down.

He'd expected, maybe, four of his friends to try it.

What he had not expected was that one of those four was a guy named Aaron Lin, who ran a tech reaction channel with something like 800,000 followers, who was apparently scrolling Twitter at that exact moment, who was apparently bored, and who retweeted the link to all of his followers with the added comment *"this looks weirdly cool, checking it out."* The retweet hit at 4:47 Pacific time on a Wednesday afternoon, which is, as it turns out, the single worst possible moment in the entire North American week to retweet anything that goes through a single server in a teenager's bedroom in Portland, Oregon.

Maya didn't know any of this yet. All she knew was that her laptop was melting, her demo song sounded like a fax machine having a bad day, and that the dashboard she had built for thirty of her friends was being used by several thousand strangers. She slammed the laptop lid down and went to find her brother.

"What did you do?"

Devan looked up from his phone. He was, she noticed, the exact color of old paper.

"I," he said, "may have... tweeted something."

The next hour was a blur of phone calls and Slack screenshots. Their uncle, Ravi, who had actually been a backend engineer at a payments company for fifteen years before quitting to consult, picked up on the second ring. He listened without interrupting. Then he said, "Okay. Don't touch anything. Don't restart anything. Tell me what you see."

"We're seeing... a lot of 503s."

"Of course you are. How many?"

Maya looked at the screen. "I think... most of them?"

"And your database?"

"Database is at one hundred percent CPU and climbing."

Ravi was quiet for a second. "How many people are on it right now?"

"Last I looked? Thirty-eight thousand."

Another pause. "Maya. I need you to understand something, and I need you to really hear it. The thing you built was not broken. Your code was correct. It worked perfectly for thirty people. For thirty-eight thousand people, on the same machine, running the way you wrote it, it was always going to fail. Not because you wrote bad code. Because what you wrote wasn't a system. It was a single worker, and you accidentally invited a crowd to a building with one door. We are going to spend the next few weeks figuring out how to give that crowd many doors. But today, I need you to learn what actually happens inside that machine when the crowd arrives. Because once you understand it, every line of code you ever write will be a little bit smarter. Deal?"

Maya, who was eighteen months away from a college applications essay topic and several months away from understanding why she should care, said, "Deal."

Ravi said, "Good. Open your laptop again. We're going to take it apart together."

This chapter is the result of that conversation. It is the conversation Maya wishes she'd had before she deployed her first real app. It is the conversation every teenager who has ever seen a system melt under unexpected success needs to have. The central question is small and enormous at the same time: what actually happens inside a server when thousands of users arrive at the same instant, and why does a program that worked for thirty people collapse for forty thousand? We are going to answer that question by slowly pulling the machine apart in our hands.

What a Request Actually Is

Before we can talk about what breaks, we have to agree on what we mean by *request*. To most teenagers, a request is something like a tap on a phone — you tap, something happens, you don't think about the chain of events that connects your finger to the answer on the screen. To make the rest of this chapter work, we have to dismantle that. We have to see the request as a physical thing, because once you see it physically, the bottleneck becomes obvious.

When your phone asks SoundSplash for a song, a small, specific sequence of events happens. Let's walk it. First, your phone needs a way to address Maya's laptop across the internet. It does this by knowing an IP address — a number like `73.220.19.4`. It then opens something called a TCP connection to that address on a specific port (port 80 for normal web traffic, port 443 for the encrypted version). Opening that connection is itself a tiny three-step handshake: your phone says "hello," the server says "hello, I see you," your phone says "great, let's talk." This handshake takes a few milliseconds even on a perfect network, longer if a packet has to bounce across the country.

Once the connection is open, your phone writes some bytes onto it. Those bytes are the request. They look like this, almost always:

```http GET /songs/42 HTTP/1.1 Host: soundsplash.app User-Agent: Mozilla/5.0 ... Accept: audio/mpeg ```

That is it. That is what a request *is*. It is bytes. A few hundred of them, written in a format invented in 1991 by a Swiss computer scientist named Tim Berners-Lee. The server, on the other end, has a piece of software listening on port 443 — Maya's app, built on Node.js — which is sitting in a state we'd politely describe as *waiting*. The instant those bytes arrive, the server's operating system parks them into a small holding area in memory called the socket buffer and signals the Node.js process: *something for you.*

Now here is the part that matters. The Node.js process has, in the simplest version, one thread of execution. A thread is a tiny engine inside your computer that runs instructions one after another, in order. It can do one thing at a time. It can read those request bytes, or it can look up which handler to call, or it can talk to the database, or it can write a response back, but it can only do one of these in any given microsecond. It is, in the metaphor Ravi would use a few minutes later, a single barista