Bluesky April 2026 Outage Post-Mortem

https://pckt.blog/b/jcalabro/april-2026-outage-post-mortem-219ebg2

by jcalabro • 3 months ago

141 78 3 months ago

What I had missed is that we deployed a new internal service last week that sent less than three GetPostRecord requests per second, but it did sometimes send batches of 15-20 thousand URIs at a time. Typically, we'd probably be doing between 1-50 post lookups per request.

That’ll do it.

bombcar• 3 months ago

Zero, one, many, many thousands.

98codes• 3 months ago

Ahh, the three relevant numbers in development: 0, 1, and infinity.

htx80nerd• 3 months ago

less than ideal if I had to be frank.

jandrese2• 3 months ago

The incredible part about this is because their backend is all TCP/IP they were literally exhausting the ports by leaving all 65k of them in TIME_WAIT, and the workaround was to start randomizing the localhost address to give them another trillion ports or so.

Night_Thastus• 3 months ago

I mean, it's one GetPostRecord, Michael. What could it cost? 1 trillion ports?

kyledrake• 3 months ago

This is a pretty interesting solution. I could see how this could useful for certain kinds of problems (as part of a ddos attack mitigation for example).

LoganDark2• 3 months ago

And then they fix the issue by using multiple localhost IPs rather than, perhaps, not sending 15-20 thousand URIs at a time

odo1242• 3 months ago

They mentioned it was a temporary fix that they removed after finding and fixing the true root cause, though.

goekjclo• 3 months ago

The timing of these log spikes lined up with drops in user-facing traffic, which makes sense. Our data plane heavily uses memcached to keep load off our main Scylla database, and if we're exhausting ports, that's a huge problem.

I expect this is common.

jmclnx• 3 months ago

Lite Blue on a dark Blue background. That is a new one, I have seen grey text on lite grey, but blue on blue ?

The article does work in lynx, at least I can read it.

rvz• 3 months ago

Thank you for the post mortem on this outage.

jonstaab6• 3 months ago

nostr never goes down

pfraze3• 3 months ago

All support to other decentralizers but nothing never goes down.

jonstaab6• 3 months ago

1000x redundancy makes it vanishingly unlikely. Although I know we're due for a pole shift so all bets are off I suppose.

nout3• 3 months ago

The comparison here is to something like TCP/IP. TCP/IP never goes down. TCP/IP is a protocol, the servers may go down and cause disruption, but the protocol doesn't really have the ability to "go down". Nostr is also a protocol. The communication on top of Nostr is pretty resilient compared to other solutions though, so that's the main highlight here.

If tens of servers go down, then some people may start noticing a bit of inconvenience. If hundreds of servers go down, then some people may need to coordinate out of bound on what relays to use, but it still generally speaking works ok.

bit1993• 3 months ago

Bitcoin, BitTorrent never go down.

jandrese2• 3 months ago

If nostr went down would people even notice?

jonstaab6• 3 months ago

probably not

nout3• 3 months ago

If any major nostr relay goes down, no one notices. That has happened many times, the network is very resilient to that.

yangm97• 3 months ago

The good thing about nostr is that, contrary to popular federated protocols, your identity is not tied to any single server, you own the keypair to your account, so you can continue using it just fine even if some relays experience a downtime.

emidoots• 3 months ago

There's stark contrast for an average human visiting the landing page of bsky.app vs nostr.org

jonstaab6• 3 months ago

That's what decentralization looks like. You might also try:

nostr.com nostr.how nostr.net nostrich.love nostrhub.io usenostr.org And of course https://github.com/nostr-protocol/nostr

electrondood• 3 months ago

Great write up... curious about the RCA. Thanks!

tapoxi3• 3 months ago

I don't really understand this architecture, but I thought Bluesky was distributed like Mastodon? How can it have an outage?

Retr0id• 3 months ago

Mastodon infra can have outages, too.

tapoxi3• 3 months ago

It's just confined to one instance if it goes down, not all of Mastodon.

pfraze3• 3 months ago

This writeup is useful for backend engineers: https://atproto.com/articles/atproto-for-distsys-engineers

The simple answer is that atproto works like the web & search engines, where the apps aggregate from the distributed accounts. So the proper analogy here would be like yahoo going down in 1999.

isodev2• 3 months ago

Google and MSN Search were already available at this time. Also websites used to publish webrings and there was IRC and forums to ask people about things.

tapoxi3• 3 months ago

This is a fantastic write-up, thanks for sharing!

fiatjaf• 3 months ago

Sorry, but this analogy is very misleading, no one browses websites through Google's servers.

For example, right now in my URL bar I read "news.ycombinator.com", not "google.com/profile/news.ycombinator.com".

If Google goes down now I can keep browsing this website and all the other websites I have in all my other tabs as if nothing had happened.

isodev2• 3 months ago

It’s more of a concept of a plan for being distributed. I even went through the trouble of hosting my own PDC and still, I was unable to use the service during the outage

LoganDark2• 3 months ago

A web interface and home server can have an outage. Bluesky is just a web interface and home server.

direwolf20• 3 months ago

It's not really distributed. It's a centralised service that pulls some parts of 0.01% of user profiles from their own servers.

chr15m2• 3 months ago

"decentralized"

gsibble• 3 months ago

Did all 3 users notice?

ffsm8• 3 months ago

Naw, only one did. Turns out the other two were his socket accounts he used to upvote and comment on his own content.

Okay, nuff trolling for today

mwkaufma• 3 months ago

Tell us more about this buggy "new internal service" that's scraping batch data :P

drewg123• 3 months ago

Golang's use of a potentially unbounded number of threads is just insane. I used to be fairly bullish on golang, but this, combined with the fact that its garbage collected, makes me feel its just unsuitable for production use.

tombert2• 3 months ago

Why does garbage collection make it unsuitable for production use? A lot of production software is written in garbage collected languages like Java. Pretty much the entire backend for iTunes/Apple Music is written in Java, and it's not doing any kind of fancy bump allocator tricks to avoid garbage. In my mind, kind of hard to argue that Apple Music is not "production use".

There are certainly plenty of projects where garbage collection is too slow, but I don't know that they're the majority, and more people would likely prefer memory safety by default.

slopinthebag3• 3 months ago

Everything is understood by comparison. Unsuitable for production use, compared to what is the more apt question.

madeofpalk• 3 months ago

Based on my experience of Apple Music being pretty bad at streaming music, i would say that it's not ready for 'production use'.

floating-io2• 3 months ago

You can have this problem with any kind of thread -- including OS threads -- if you do an unbounded spawn loop. Go is hardly unique in this.

Goroutines are actually better AFAIK because they distribute work on a thread pool that can be much smaller than the number of active goroutines.

If my quick skim created a correct understanding, then the problem here looks more like architecture. Put simply: does the memcached client really require a new TCP connection for every lookup? I would think you would pool those connections just like you would a typical database and keep them around for approximately forever. Then they wouldn't have spammed memcache with so many connections in the first place...

(edit: ah, it looks like they do use a pool, but perhaps the pool does not have a bounded upper size, which is its own kind of fail.)

slopinthebag3• 3 months ago

Rust's async doesn't have this issue. Or at least, it's the same issue as malloc in an unbounded loop, but that's a more general issue not related to async or threading.

15-20 thousand futures would be trivial. 15-20 thousand goroutines, definitely not.

pembrook2• 3 months ago

Distributed social media goes down? hrmmm.

Email and the internet don't have "downtime." Certain key infra providers do of course. ISPs can go down. DNS providers can go down. But the internet and email itself can't go down absent a global electricity outage.

You haven't built a decentralized network until you reach that standard imo. Otherwise its just "distributed protocol" cosplay. Nice costume. Kind of like how everybody has been amnesia'd into thinking Obsidian is open source when it really isn't.

iAMkenough• 3 months ago

Bluesky is a provider. Blacksky didn’t go down.

pembrook2• 3 months ago

Is there anything running on Blacksky other than Bluesky with more than say, 100 active users?

AOL never even got to that level of dominance in the internet 1.0 era.

The point is it's not a distributed network if one node is 99.9% of all traffic.

opem• 3 months ago

At least they aren't hiding and transparent about it unlike the big tech corps with so called SLAs

tmpz22• 3 months ago

There are no outages in Azure sing se.

_heimdall2• 3 months ago

GitHub's Ops team would approve this message, I assume.

thedrexster• 3 months ago

i see you, brother! <3

streetfighter64• 3 months ago

They represent real user-facing downtime

Off-topic, but "real" feels like the new "delve". Is there such a thing as "fake" or "virtual" downtime, or why do people feel the need to specify that all manner of things are "real" nowadays?

mwagstaff• 3 months ago

With my SRE hat on, dare I ask... could/should this have been picked up in testing?

And then normally there's a nice discussion about how production is very different to the test environment.

heliumtera• 3 months ago

Good to know the discussion about decentralization and federation had finally ended

Bluesky April 2026 Outage Post-Mortem

Related Stories