Ktor streaming response backpressure and memory exhaustion risks

Answer to the Question

When you use call.respondStream or write directly to a ByteWriteChannel, Ktor does not copy the entire payload into memory. Instead, the data is produced by a coroutine that writes to a channel whose internal buffer has a configurable size (default 8 KiB). The write operation is a suspending call: if the buffer is full, the coroutine that is producing data suspends until the channel’s consumer (the HTTP client) has drained enough space. This is Ktor’s built‑in backpressure mechanism.

Key Points

• The backpressure is applied only while the producer runs inside the same coroutine scope that handles the request. If you launch the producer in GlobalScope or another detached scope, the write call will not suspend the original coroutine, and the buffer can grow unchecked.
• Blocking operations inside the producer (e.g., Thread.sleep(), synchronous JDBC calls) prevent the coroutine from suspending, so backpressure is effectively disabled.
• When the client disconnects, the request’s coroutine is cancelled. A well‑behaved producer should check coroutineContext.isActive or rely on the suspending write to stop promptly.

Practical Steps for This Scenario

1. Write the stream inside the request coroutine:

   call.respondStream {
       for (i in 1..10000) {
           writeChannel.write(i.toByte())
           delay(10) // keep the producer suspending
       }
   }

2. Avoid GlobalScope.launch or other detached coroutines for data generation.

3. Do not use blocking calls inside the streaming lambda. If you must call a blocking API, wrap it with withContext(Dispatchers.IO) { … }.

4. Configure the buffer size if you need tighter control: application.conf can set ktor.application.sendBufferSize to 2 KiB, 16 KiB, etc. The backpressure threshold scales with this value.

5. Verify memory usage by running a throttled client (e.g., curl --limit-rate 1k) and monitoring the JVM heap. Stable, low memory indicates correct backpressure handling.

Missing Diagnostic Detail

To tailor the recommendation, could you confirm whether the data source is launched inside the request coroutine or in a detached scope? This determines whether backpressure is already in effect.