App Design · News · Open-sourced a rate-limiting middleware for app-design-news with token bucket and sliding window

2.3K
ADr/app-design-news·posted by huang_ke·5 minutes agoAnnouncement

Open-sourced a rate-limiting middleware for app-design-news with token bucket and sliding window

Most app-design-news articles stop at "how to use it" and never cover "when not to use it". This is an attempt at the second half.

// Minimal reproduction: you must use a real long-tail distribution here.
// Uniform load-test traffic will never trigger this.
func (s *Server) handle(ctx context.Context) error {
    conn, err := s.pool.Acquire(ctx)
    if err != nil {
        return fmt.Errorf("acquire: %w", err)
    }
    defer conn.Release()

    return s.do(ctx, conn)
}

One last trap: in container environments remember to adjust the memory-related parameters in step. Otherwise the host limit and the process expectation disagree, and the symptom is intermittent, unreproducible failure.

On trade-offs, my view is this: if nobody on the team owns this area long-term, do not introduce a second mechanism. With two coexistence you first have to work out which one is even in play when things break, and that costs far more than the performance you saved.

We also fixed monitoring along the way: replaced average-based alerts with percentiles and split them per endpoint. False alerts dropped by about seventy percent and the on-call rotation visibly cheered up.

929 comments

929 comments

· first 120 loaded
M
Kkite·28 minutes ago

Worth learning from this debugging approach. We went straight at the logs and took a much longer route.

506
Bbob_chenOP·2 days agoedited

There is actually a simpler fix that needs no architecture change: move this check up to the gateway and the problem disappears. The cost is one extra lookup at the gateway.

270
Cchen_dev·2 days ago

Can you give a minimal reproduction? I ran it locally for ten minutes and could not reproduce on macOS with the latest version.

319
Kkite·2 days ago

I see point 3 differently. The trade-off depends on your read/write ratio: read-heavy with little writing means caching actually widens the inconsistency window.

137
Sswoole_leeOP·2 days ago

I just read the app-design-news source — the author actually explains the reasoning in a comment, roughly "so that it degrades into predictable behaviour in extreme cases".

254
Wwinter·28 minutes ago

Saved. I am reworking this area this week — this saves a lot of wrong turns.

306
Sswoole_lee·2 days ago

I just read the app-design-news source — the author actually explains the reasoning in a comment, roughly "so that it degrades into predictable behaviour in extreme cases".

3
Mmike_xu·3 minutes ago

This matches what we see in production. We only hit it past 3k QPS; the earlier load tests showed nothing — the test traffic was too clean, with no long-tail requests.

81
Rran_bo·2 days ago

There is actually a simpler fix that needs no architecture change: move this check up to the gateway and the problem disappears. The cost is one extra lookup at the gateway.

1
Zzhou_yi·2 days agoedited

Has anyone run a controlled experiment? I did, reducing it to a single variable, and the difference was 4% — within noise. So I suspect the main cause is something else.

1
Hhuang_ke·2 days ago

There is actually a simpler fix that needs no architecture change: move this check up to the gateway and the problem disappears. The cost is one extra lookup at the gateway.

301
Wwinter·28 minutes ago

Saved. I am reworking this area this week — this saves a lot of wrong turns.

291
Wwinter·yesterday

One counter-example: below app-design-news 7.4 the semantics of that code are different, so do not copy it verbatim. We got burned in staging and rolled back once.

32
Aalice_dev·1 hour agoedited

Has anyone run a controlled experiment? I did, reducing it to a single variable, and the difference was 4% — within noise. So I suspect the main cause is something else.

452
Sslow_queryOP·2 days agoedited

Sharing our numbers, 8 cores 16GB, same scenario:

| Concurrency | P50 | P99 |
|---|---|---|
| 200 | 12ms | 88ms |
| 500 | 31ms | 340ms |

P99 clearly collapses at 500 concurrency, which lines up with your knee point.

38
Hhuang_ke·2 days ago

Sharing our numbers, 8 cores 16GB, same scenario:

| Concurrency | P50 | P99 |
|---|---|---|
| 200 | 12ms | 88ms |
| 500 | 31ms | 340ms |

P99 clearly collapses at 500 concurrency, which lines up with your knee point.

57
Rran_bo·just now

One counter-example: below app-design-news 7.4 the semantics of that code are different, so do not copy it verbatim. We got burned in staging and rolled back once.

27
Sslow_query·1 hour ago

One counter-example: below app-design-news 7.4 the semantics of that code are different, so do not copy it verbatim. We got burned in staging and rolled back once.

50
Wwinter·3 minutes ago

Agreeing with the above. One addition: with this option enabled the GC count in your metrics doubles, so adjust the alert threshold at the same time or it will keep firing.

6
Sslow_query·2 days ago

We have run this in production for two years without hitting it. That said, we never reached this scale, so our experience is not really evidence here.

364
Sslow_query·2 days agoedited

I see point 3 differently. The trade-off depends on your read/write ratio: read-heavy with little writing means caching actually widens the inconsistency window.

7
Wwinter·2 days agoLevel 6

Thanks for sharing real numbers — far more useful than the articles that only cover concepts.

419
Lli_ming·2 days ago

This matches what we see in production. We only hit it past 3k QPS; the earlier load tests showed nothing — the test traffic was too clean, with no long-tail requests.

7
Cchen_dev·2 days ago

Has anyone run a controlled experiment? I did, reducing it to a single variable, and the difference was 4% — within noise. So I suspect the main cause is something else.

499
Wwinter·2 days agoeditedLevel 6

Can you give a minimal reproduction? I ran it locally for ten minutes and could not reproduce on macOS with the latest version.

26
Sslow_query·2 days ago

This matches what we see in production. We only hit it past 3k QPS; the earlier load tests showed nothing — the test traffic was too clean, with no long-tail requests.

444
Oops_wang·2 days agoLevel 6

Worth learning from this debugging approach. We went straight at the logs and took a much longer route.

74
Sslow_query·2 days agoLevel 6

Has anyone run a controlled experiment? I did, reducing it to a single variable, and the difference was 4% — within noise. So I suspect the main cause is something else.

37
Zzhu_zong·2 days agoLevel 6

Worth learning from this debugging approach. We went straight at the logs and took a much longer route.

2
Sswoole_lee·2 days agoedited

Sharing our numbers, 8 cores 16GB, same scenario:

| Concurrency | P50 | P99 |
|---|---|---|
| 200 | 12ms | 88ms |
| 500 | 31ms | 340ms |

P99 clearly collapses at 500 concurrency, which lines up with your knee point.

44
Zzhu_zong·2 days ago

Worth learning from this debugging approach. We went straight at the logs and took a much longer route.

286
Wwinter·2 days ago

Thanks for sharing real numbers — far more useful than the articles that only cover concepts.

269
Rrase·2 days ago

I see point 3 differently. The trade-off depends on your read/write ratio: read-heavy with little writing means caching actually widens the inconsistency window.

207
Ddev_zhou·5 hours ago

Thanks for sharing real numbers — far more useful than the articles that only cover concepts.

201
Llinlin·1 hour ago

Sharing our numbers, 8 cores 16GB, same scenario:

| Concurrency | P50 | P99 |
|---|---|---|
| 200 | 12ms | 88ms |
| 500 | 31ms | 340ms |

P99 clearly collapses at 500 concurrency, which lines up with your knee point.

196
Hhuang_ke·2 days ago

Thanks for sharing real numbers — far more useful than the articles that only cover concepts.

38
Ddev_zhou·2 hours ago

There is actually a simpler fix that needs no architecture change: move this check up to the gateway and the problem disappears. The cost is one extra lookup at the gateway.

35
Wwinter·2 days ago

A question: what changes in a container with a 512Mi memory limit? That is how we run it in production.

266
Lli_ming·2 days ago

We have run this in production for two years without hitting it. That said, we never reached this scale, so our experience is not really evidence here.

30
Kkernel_panic·2 days ago

Saved. I am reworking this area this week — this saves a lot of wrong turns.

176
Sslow_queryOP·2 days ago

One counter-example: below app-design-news 7.4 the semantics of that code are different, so do not copy it verbatim. We got burned in staging and rolled back once.

116
Hhuang_ke·2 days ago

Can you give a minimal reproduction? I ran it locally for ten minutes and could not reproduce on macOS with the latest version.

167
Wwinter·2 days ago

This is not a app-design-news problem, it is a usage problem. The docs say this API is not thread-safe and you must lock around it yourself.

163
Sslow_query·just nowedited

Can you give a minimal reproduction? I ran it locally for ten minutes and could not reproduce on macOS with the latest version.

159
NnikicMod·28 minutes ago

There is actually a simpler fix that needs no architecture change: move this check up to the gateway and the problem disappears. The cost is one extra lookup at the gateway.

231
Cchen_dev·12 minutes ago

This matches what we see in production. We only hit it past 3k QPS; the earlier load tests showed nothing — the test traffic was too clean, with no long-tail requests.

488
Sswoole_lee·28 minutes ago

This is not a app-design-news problem, it is a usage problem. The docs say this API is not thread-safe and you must lock around it yourself.

367
Mmike_xu·2 days ago

I see point 3 differently. The trade-off depends on your read/write ratio: read-heavy with little writing means caching actually widens the inconsistency window.

9
Aalice_dev·2 hours ago

This is not a app-design-news problem, it is a usage problem. The docs say this API is not thread-safe and you must lock around it yourself.

133
Cchen_dev·2 days ago

Agreeing with the above. One addition: with this option enabled the GC count in your metrics doubles, so adjust the alert threshold at the same time or it will keep firing.

172
Hhuang_ke·2 days agoedited

Can you give a minimal reproduction? I ran it locally for ten minutes and could not reproduce on macOS with the latest version.

5
Kkite·2 days ago

A question: what changes in a container with a 512Mi memory limit? That is how we run it in production.

483
Kkernel_panic·2 days ago

Can you give a minimal reproduction? I ran it locally for ten minutes and could not reproduce on macOS with the latest version.

227
Wwinter·2 days ago

Agreeing with the above. One addition: with this option enabled the GC count in your metrics doubles, so adjust the alert threshold at the same time or it will keep firing.

5
Ddev_zhou·2 days agoedited

We have run this in production for two years without hitting it. That said, we never reached this scale, so our experience is not really evidence here.

151
Lli_ming·2 days agoedited

A question: what changes in a container with a 512Mi memory limit? That is how we run it in production.

149
Aalice_dev·2 days agoedited

Has anyone run a controlled experiment? I did, reducing it to a single variable, and the difference was 4% — within noise. So I suspect the main cause is something else.

393
Bbob_chen·2 days ago

We have run this in production for two years without hitting it. That said, we never reached this scale, so our experience is not really evidence here.

22
Lli_ming·2 days ago

I just read the app-design-news source — the author actually explains the reasoning in a comment, roughly "so that it degrades into predictable behaviour in extreme cases".

93
Oops_wang·2 days ago

There is actually a simpler fix that needs no architecture change: move this check up to the gateway and the problem disappears. The cost is one extra lookup at the gateway.

143
Lli_ming·2 days ago

Has anyone run a controlled experiment? I did, reducing it to a single variable, and the difference was 4% — within noise. So I suspect the main cause is something else.

137
Bbob_chen·1 hour ago

A question: what changes in a container with a 512Mi memory limit? That is how we run it in production.

126
Ttang_haoOP·2 days ago

Thanks for sharing real numbers — far more useful than the articles that only cover concepts.

62
RraseOP·2 days agoedited

We have run this in production for two years without hitting it. That said, we never reached this scale, so our experience is not really evidence here.

54
Aalice_dev·2 days ago

This is not a app-design-news problem, it is a usage problem. The docs say this API is not thread-safe and you must lock around it yourself.

499
Kkernel_panic·2 days ago

This matches what we see in production. We only hit it past 3k QPS; the earlier load tests showed nothing — the test traffic was too clean, with no long-tail requests.

110
Aalice_dev·2 days ago

Sharing our numbers, 8 cores 16GB, same scenario:

| Concurrency | P50 | P99 |
|---|---|---|
| 200 | 12ms | 88ms |
| 500 | 31ms | 340ms |

P99 clearly collapses at 500 concurrency, which lines up with your knee point.

100
Kkite·2 days ago

One counter-example: below app-design-news 7.4 the semantics of that code are different, so do not copy it verbatim. We got burned in staging and rolled back once.

97
Ddev_zhouOP·just now

Worth learning from this debugging approach. We went straight at the logs and took a much longer route.

3
Ddev_zhouOP·2 days ago

Thanks for sharing real numbers — far more useful than the articles that only cover concepts.

182
Ttang_hao·2 days ago

We have run this in production for two years without hitting it. That said, we never reached this scale, so our experience is not really evidence here.

267
Wwinter·2 days ago

One counter-example: below app-design-news 7.4 the semantics of that code are different, so do not copy it verbatim. We got burned in staging and rolled back once.

18
Ddev_zhou·yesterday

Agreeing with the above. One addition: with this option enabled the GC count in your metrics doubles, so adjust the alert threshold at the same time or it will keep firing.

2
Rrase·2 days ago

Saved. I am reworking this area this week — this saves a lot of wrong turns.

1
Lli_ming·2 days ago

One counter-example: below app-design-news 7.4 the semantics of that code are different, so do not copy it verbatim. We got burned in staging and rolled back once.

353
Ddev_zhou·2 days ago

Can you give a minimal reproduction? I ran it locally for ten minutes and could not reproduce on macOS with the latest version.

221
Llinlin·2 days ago

Sharing our numbers, 8 cores 16GB, same scenario:

| Concurrency | P50 | P99 |
|---|---|---|
| 200 | 12ms | 88ms |
| 500 | 31ms | 340ms |

P99 clearly collapses at 500 concurrency, which lines up with your knee point.

18
Rran_bo·2 days ago

I see point 3 differently. The trade-off depends on your read/write ratio: read-heavy with little writing means caching actually widens the inconsistency window.

46
Rran_bo·2 hours ago

This is not a app-design-news problem, it is a usage problem. The docs say this API is not thread-safe and you must lock around it yourself.

43
Ttang_hao·2 days ago

I just read the app-design-news source — the author actually explains the reasoning in a comment, roughly "so that it degrades into predictable behaviour in extreme cases".

437
Oops_wang·2 days agoedited

This matches what we see in production. We only hit it past 3k QPS; the earlier load tests showed nothing — the test traffic was too clean, with no long-tail requests.

271
Rrase·2 days ago

I just read the app-design-news source — the author actually explains the reasoning in a comment, roughly "so that it degrades into predictable behaviour in extreme cases".

1
Aalice_dev·2 days ago

Saved. I am reworking this area this week — this saves a lot of wrong turns.

1
Aalice_dev·2 hours ago

Has anyone run a controlled experiment? I did, reducing it to a single variable, and the difference was 4% — within noise. So I suspect the main cause is something else.

21
Oops_wang·12 minutes ago

Saved. I am reworking this area this week — this saves a lot of wrong turns.

42
Ttang_hao·2 days ago

I just read the app-design-news source — the author actually explains the reasoning in a comment, roughly "so that it degrades into predictable behaviour in extreme cases".

41
Nnikic·just now

This is not a app-design-news problem, it is a usage problem. The docs say this API is not thread-safe and you must lock around it yourself.

35
Kkernel_panic·2 days ago

I just read the app-design-news source — the author actually explains the reasoning in a comment, roughly "so that it degrades into predictable behaviour in extreme cases".

34
Zzhu_zong·2 days ago

I see point 3 differently. The trade-off depends on your read/write ratio: read-heavy with little writing means caching actually widens the inconsistency window.

30
Kkernel_panic·2 days ago

Thanks for sharing real numbers — far more useful than the articles that only cover concepts.

29
Cchen_devOP·2 days ago

This matches what we see in production. We only hit it past 3k QPS; the earlier load tests showed nothing — the test traffic was too clean, with no long-tail requests.

20
Hhuang_ke·2 days ago

Agreeing with the above. One addition: with this option enabled the GC count in your metrics doubles, so adjust the alert threshold at the same time or it will keep firing.

12
Llinlin·2 days ago

This is not a app-design-news problem, it is a usage problem. The docs say this API is not thread-safe and you must lock around it yourself.

10
Hhuang_ke·1 hour ago

Sharing our numbers, 8 cores 16GB, same scenario:

| Concurrency | P50 | P99 |
|---|---|---|
| 200 | 12ms | 88ms |
| 500 | 31ms | 340ms |

P99 clearly collapses at 500 concurrency, which lines up with your knee point.

7
Sswoole_lee·2 days ago

This is not a app-design-news problem, it is a usage problem. The docs say this API is not thread-safe and you must lock around it yourself.

276
Oops_wang·2 days ago

Can you give a minimal reproduction? I ran it locally for ten minutes and could not reproduce on macOS with the latest version.

33
Nnikic·2 days ago

Sharing our numbers, 8 cores 16GB, same scenario:

| Concurrency | P50 | P99 |
|---|---|---|
| 200 | 12ms | 88ms |
| 500 | 31ms | 340ms |

P99 clearly collapses at 500 concurrency, which lines up with your knee point.

31
Zzhou_yi·2 days ago

Thanks for sharing real numbers — far more useful than the articles that only cover concepts.

433
Ddev_zhou·1 hour ago

There is actually a simpler fix that needs no architecture change: move this check up to the gateway and the problem disappears. The cost is one extra lookup at the gateway.

37
Mmike_xu·2 days ago

Agreeing with the above. One addition: with this option enabled the GC count in your metrics doubles, so adjust the alert threshold at the same time or it will keep firing.

25
Kkite·2 days ago

There is actually a simpler fix that needs no architecture change: move this check up to the gateway and the problem disappears. The cost is one extra lookup at the gateway.

435
Rran_bo·yesterday

A question: what changes in a container with a 512Mi memory limit? That is how we run it in production.

7
Ttang_hao·2 days ago

This matches what we see in production. We only hit it past 3k QPS; the earlier load tests showed nothing — the test traffic was too clean, with no long-tail requests.

235
Sslow_query·just now

A question: what changes in a container with a 512Mi memory limit? That is how we run it in production.

3
Aalice_dev·2 days ago

I see point 3 differently. The trade-off depends on your read/write ratio: read-heavy with little writing means caching actually widens the inconsistency window.

132
Sslow_queryOP·2 hours ago

We have run this in production for two years without hitting it. That said, we never reached this scale, so our experience is not really evidence here.

22
Bbob_chenOP·2 days ago

Worth learning from this debugging approach. We went straight at the logs and took a much longer route.

22
Rrase·5 hours agoLevel 6

One counter-example: below app-design-news 7.4 the semantics of that code are different, so do not copy it verbatim. We got burned in staging and rolled back once.

11
Zzhou_yi·2 days agoLevel 6

A question: what changes in a container with a 512Mi memory limit? That is how we run it in production.

8
Zzhu_zong·3 minutes agoedited

Worth learning from this debugging approach. We went straight at the logs and took a much longer route.

9
Wwinter·2 days agoeditedLevel 6

I just read the app-design-news source — the author actually explains the reasoning in a comment, roughly "so that it degrades into predictable behaviour in extreme cases".

40
Hhuang_ke·2 days ago

We have run this in production for two years without hitting it. That said, we never reached this scale, so our experience is not really evidence here.

3
Oops_wang·2 days ago

Worth learning from this debugging approach. We went straight at the logs and took a much longer route.

425
Sswoole_lee·1 hour ago

Saved. I am reworking this area this week — this saves a lot of wrong turns.

4
Hhuang_ke·2 days ago

Agreeing with the above. One addition: with this option enabled the GC count in your metrics doubles, so adjust the alert threshold at the same time or it will keep firing.

3
Wwinter·just now

Has anyone run a controlled experiment? I did, reducing it to a single variable, and the difference was 4% — within noise. So I suspect the main cause is something else.

1
Kkite·2 days ago

Agreeing with the above. One addition: with this option enabled the GC count in your metrics doubles, so adjust the alert threshold at the same time or it will keep firing.

1
Rrase·2 days ago

A question: what changes in a container with a 512Mi memory limit? That is how we run it in production.

1
Llinlin·2 days ago

Saved. I am reworking this area this week — this saves a lot of wrong turns.

355
Rran_bo·2 days ago

I see point 3 differently. The trade-off depends on your read/write ratio: read-heavy with little writing means caching actually widens the inconsistency window.

1

This is the post detail page /en/c/app-design-news/post/p6. Posts and comments are generated deterministically from a seeded PRNG, so the same post always renders the same content and the link can be shared, reloaded and indexed. In production this page reads MySQL for the post, Redis for hot-post caching, and fetches the whole comment tree in a single query on the path column.

See the database schema →