Why does a Plotly Dash app that caches a DataFrame in a global break with many users?

## The property being violated Dash's server is stateless by design. `app.layout` and the callback registry are built once at import; after that, every user interaction is an isolated POST to the update endpoint. The function runs, returns JSON, and the process forgets everything that was not written down somewhere durable. Assigning to a module-level variable inside a callback writes to the **process**, and a process is shared by every user routed to it and invisible to every other process. ``` df_cache = None # module level @callback(Output("tbl", "data"), Input("region", "value")) def load(region): global df_cache df_cache = query(region) # process state return df_cache.to_dict("records") ``` ## The two failure modes **Cross-user leakage (single worker).** User A selects EMEA; `df_cache` now holds EMEA rows. User B's callback reads `df_cache` and gets EMEA. If the data is permissioned, this is a data-leak incident, not a bug report. **Nondeterminism (multiple workers).** Production runs `gunicorn app:server -w 4`. Each worker is a separate OS process with its own copy of the module. A user's first callback writes the global in worker 2; the next callback lands on worker 3, where the global is still `None`. The app fails roughly (workers − 1)/workers of the time, in a pattern that looks random and never reproduces under a single-process dev server. Threaded workers add the same problem plus a race on the assignment. A third, quieter mode is memory: a global keyed by user id and never evicted grows until the worker is OOM-killed and silently restarted, taking every other user's in-flight state with it. ## Where the state should go **Recompute, and cache the computation, not the session.** The cleanest Dash apps hold no session state at all: each callback derives what it needs from its inputs. Make that affordable by memoising the expensive step on its arguments — Flask-Caching backed by Redis, or `functools.lru_cache` for genuinely process-local, read-only work. The cache key is the query parameters, not the user, so sharing it is correct rather than a leak. **`dcc.Store` for small per-user state.** A `dcc.Store` component in the layout holds JSON in the browser and is passed into callbacks like any other property. `storage_type="memory"` clears on refresh, `"session"` survives reload within the tab, `"local"` persists across sessions. Because it round-trips with every callback that reads it, keep it to kilobytes — filter selections, a computed summary, an id — never a full result set. **An external store for large per-user state.** Write the intermediate frame to Redis or object storage under a session-scoped key, and pass only the key through `dcc.Store`. This is the standard "expensive query shared by three callbacks" pattern: one callback computes and stores, the others read by key. Give the keys a TTL, or the store is a leak with a slower fuse. **Read-only globals are fine.** A reference table, a fitted model, a shapefile loaded once at import and never written is exactly what a global is for. Each worker gets its own copy — budget the memory for that — but there is no correctness problem, because there is nothing to race and nothing user-specific in it. ## Diagnosing it in the wild The tells are characteristic: works in development and fails in production; failure rate that changes when you change the worker count; a user reporting someone else's numbers; a bug that disappears on retry. If you suspect it, set workers to 1 and see whether the intermittency vanishes into a consistent cross-user bug — that pair of symptoms is close to conclusive. The structural fix is a rule, not a patch: **no callback assigns to anything outside its own scope.** State either rides in the request as component properties, sits in the browser in a `dcc.Store`, or lives in a real store with a key and a TTL. Applied consistently, the app scales horizontally with no session affinity, which is Dash's actual operational advantage over session-bound frameworks — and throwing it away with a global is a needless loss.