Problems / Security, hard
Asked at Ticketmaster and Amazon. Tickets go on sale at 5 s: real fans arrive at six times normal traffic for 15 seconds, and 8,000 requests a second of bots start a second earlier. Everything hits one API and one Postgres database; two fans can hold the same seat.
Unlock it once for 25 credits; everything inside it is free (runs, changes, Submit, results, hints). Sign in with Google to start; new accounts get free credits.
Success ≥ 98.5% for real fans, p99 ≤ 2 s, no seat sold twice, at least 95% of bots blocked, for at most $720,000 a month.
Like a coding problem, a solution has to pass every case, not just the one it was built for. Submit in the lab runs all 4; 1 of them are hidden until then.
2,500 requests a second for 20 seconds: 75% browse (reads), 20% hold (writes), 5% buy (writes).
What each component does in this design, and what calls it. The simulator mimics each one from these settings.
| Component | Its job here | Settings |
|---|---|---|
| Load balancerLoad balancer | Traffic enters here.Calls Ticketing API.Layer 4 balancers route by IP and port; layer 7 balancers read HTTP and can route by path or header. | – |
| Ticketing APIApp service | Load balancer forwards to it.Calls Seats and orders (Postgres), Card payments.Little's law: throughput ≈ concurrency ÷ latency. 200 slots at 50 ms serve about 4,000 req/s. | 6 replicas × 100 slots · timeout 1.0 s |
| Seats and orders (Postgres)SQL database | Ticketing API calls it.Postgres runs one process per connection, which is why poolers like PgBouncer sit in front of busy databases. | 8 vCPU · 400 connections |
| Card paymentsPayment gateway | Ticketing API calls it for /buy.Payment providers accept an idempotency key so a retried charge is not taken twice. | 500 slots |