Live data from Hacker News

We built a self-healing system to survive a concurrency bug at Netflix

pushtoprod.substack.com

161–170 of 184 posts

Re: We built a self-healing system to survive a concurrency bug at Netflix

#161

Earlier quoted context omitted.

"certain kind" of discipline, indeed... not the good kind. and while your comment goes to great pains to highlight how that particular God is dead (and i agree, for the record), the God of Quality (the one that Pirsig goes to great lengths to not really define) toward which the engineer's heart of heart prays that lives within us all is... unimpressed, to say the least.

Sure, you worship the God of Quality until you realize that memory leak is being caused by a 3rd party library (extra annoying when you could have solved it yourself) or a quirky stdlib implementation Then you realize it's a paper idol and the best you can do is suck less than the average. Thanks for playing Wing Commander!

>> Thanks for playing Wing Commander!

captain america voice I got that reference :-)

Re: We built a self-healing system to survive a concurrency bug at Netflix

#162
post #159

Earlier quoted context omitted.

Is it? It's pretty rare to download assets from servers that you're uploading to. Sometimes you have truly interactive app servers but that's a pretty small percentage of web traffic. Shared state is not the typical problem to solve on the internet, though it is a popular one to discuss.

Whatever your service is, usually the database is the bottleneck. The database limits the latency, scaling and availability. Of course, how much, depends on the service. Particularly, how much concurrent writing is happening, and do you need to update this state globally, in real-time as result of this writing. Also, is local caching happening and do you need to invalidate the cache as well as a result of this writin…

> Whatever your service is, usually the database is the bottleneck. The database limits the latency, scaling and availability.

Database-driven traffic is still a tiny percentage of internet traffic. It's harder to tell these days with encryption but on any given page-load on any project I've worked on, most of the traffic is in assets, not application data.

Now, latency might be a different issue, but it seems ridiculous to me to consider "downloading a file" to be a niche concern—it's just that most people offload that concern to other people.

Re: We built a self-healing system to survive a concurrency bug at Netflix

#163
post #115

Earlier quoted context omitted.

Not really. People are not posting data into Netlix. Netflix is mostly read-only. That is huge complexity reducer.

Is it? It's pretty rare to download assets from servers that you're uploading to. Sometimes you have truly interactive app servers but that's a pretty small percentage of web traffic. Shared state is not the typical problem to solve on the internet, though it is a popular one to discuss.

[dead]

Re: We built a self-healing system to survive a concurrency bug at Netflix

#164
post #159

Earlier quoted context omitted.

Whatever your service is, usually the database is the bottleneck. The database limits the latency, scaling and availability. Of course, how much, depends on the service. Particularly, how much concurrent writing is happening, and do you need to update this state globally, in real-time as result of this writing. Also, is local caching happening and do you need to invalidate the cache as well as a result of this writin…

> Whatever your service is, usually the database is the bottleneck. The database limits the latency, scaling and availability. Database-driven traffic is still a tiny percentage of internet traffic. It's harder to tell these days with encryption but on any given page-load on any project I've worked on, most of the traffic is in assets, not application data. Now, latency might be a different issue, but it seems ridicu…

[dead]

Re: We built a self-healing system to survive a concurrency bug at Netflix

#165

Earlier quoted context omitted.

Heroku reboots servers every night no matter what stack is running on them. Same idea. The problem is that you merely borrowed yourself some time. As time goes on, more inefficiencies/bugs of this nature will creep in unnoticed, some will perhaps silently corrupt data before it is noticed (!), and it will be vastly more difficult at that point to troubleshoot 10 bugs of varying degrees of severity and frequency all h…

Also, it means you are married to the reboot process. If you loose control of your memory management process too much, you'll never be able to fix it absent a complete rewrite. I worked at a place that had a lot of (c++) CGI programs with a shocking level of disregard for freeing memory, but that was ok because when the CGI request was over the process restarted. But then they reused that same code in SOA/long lived…

I never considered "having to reboot" as "introducing another dependency" (in the sense of wanting to keep those at a minimum) but sure enough, it is.

Also, great point about (depending on your architecture) losing the ability to do things like cache results

Re: We built a self-healing system to survive a concurrency bug at Netflix

#166
post #123

Earlier quoted context omitted.

This sounds terrible

To be fair this is what the BEAM vm structures everything on: If something is wonky, crash it and restart from a known ok state. Except when BEAM does it everyone says it's brilliant

It's one thing to design a crash-only system, and a quite different to design a system that crashes all the time but paper over it with a cloud orchestration layer later.

Re: We built a self-healing system to survive a concurrency bug at Netflix

#167
post #159

Earlier quoted context omitted.

Whatever your service is, usually the database is the bottleneck. The database limits the latency, scaling and availability. Of course, how much, depends on the service. Particularly, how much concurrent writing is happening, and do you need to update this state globally, in real-time as result of this writing. Also, is local caching happening and do you need to invalidate the cache as well as a result of this writin…

> Whatever your service is, usually the database is the bottleneck. The database limits the latency, scaling and availability. Database-driven traffic is still a tiny percentage of internet traffic. It's harder to tell these days with encryption but on any given page-load on any project I've worked on, most of the traffic is in assets, not application data. Now, latency might be a different issue, but it seems ridicu…

> It's harder to tell these days with encryption but on any given page-load on any project I've worked on, most of the traffic is in assets, not application data.

Yet you have to design the whole infrastructure to note that tiny margin to work flawlessly, because otherwise the service usually is not driving its purpose.

Read-only assets are the easy part, which was my original claim.

Re: We built a self-healing system to survive a concurrency bug at Netflix

#168
That presumably fixed things from a deployment point of view, but if there was a concurrency bug involving a hashmap, the service may have been emitting incorrect results.

For example: calculate hash code of string, determine index, find apparent match, hashmap is modified by another thread, return value at that index which no longer matches.

I don't think that particular issue can happen with Java's HashMap, but there's probably some sort of similar goofiness.

Re: We built a self-healing system to survive a concurrency bug at Netflix

#169

Earlier quoted context omitted.

Heroku reboots servers every night no matter what stack is running on them. Same idea. The problem is that you merely borrowed yourself some time. As time goes on, more inefficiencies/bugs of this nature will creep in unnoticed, some will perhaps silently corrupt data before it is noticed (!), and it will be vastly more difficult at that point to troubleshoot 10 bugs of varying degrees of severity and frequency all h…

Also, it means you are married to the reboot process. If you loose control of your memory management process too much, you'll never be able to fix it absent a complete rewrite. I worked at a place that had a lot of (c++) CGI programs with a shocking level of disregard for freeing memory, but that was ok because when the CGI request was over the process restarted. But then they reused that same code in SOA/long lived…

You kinda want some machines to reboot less frequently than others, so issues don't creep up on you.

You also want some machines to reboot much more frequently than others, so you catch boot issues before they affect your entire fleet.

Re: We built a self-healing system to survive a concurrency bug at Netflix

#170
post #82

Earlier quoted context omitted.

This has been done forever. Ops team had cronjobs to restart misbehaving applications out of business hours since before I started working. In a previous job, the solution for disks being full on a VM on-prem (no, not databases) was an automatic reimage. I've seen scheduled index rebuilds on Oracle. The list goes on.

Rebooting Windows IIS instances every night has been a mainstay for most of my career. haha

I’ve got an IIS instance pushing eight years of uptime… auto pool recycling is disabled.
Post reply on HN