Three ways, which work together. All are under the service's Scaling, with the servers it runs on and what it does when nobody uses it: a bigger size (more memory and cores for each container, given to it as it runs, with no restart), more instances, and more containers under load. Each container is billed at its size while it's awake.
Three ways to scale, which work together. A bigger size gives each container more memory and cores, as it runs, with no restart (m to xl, say). More instances run one in each region you pick, each on a server of its own, like web in Europe and in the US; visitors reach the nearest awake one. More containers start under load, up to 20 per instance (#1, #2, #3 on one server), and when its servers are full another server in the region runs it too. Each container is billed at its size while it's awake.
Under Scaling → Regions, pick the regions it runs in: it runs one instance in each, on a server of its own there (Hobby up to 3, Business up to 10). Visitors reach the nearest awake one; if a server goes down, the others answer. Anywhere is one instance, on the server Alf picks. Where services run says how it chooses, and when instances move.
The API and alf.toml can say more: instances (several, spread by themselves) or region_instances ({"Europe": 2}), for more than one in a region.
Each instance of a public service can start more containers when it's busy (Scaling → Under load):
When load stays lower for a minute, extra containers drain (finishing their open requests) and stop. Scaling → Where it runs lists each container under its server: its own (#1) and the ones added under load (#2 and up), with how long each has been up, its open requests, memory and CPU, and the requests per second they're for. The Replicas chart on its Overview shows how many over time. Each is billed at its size while it runs.
The Container menu at the top of a service's Overview, Logs and Terminal picks one of them (or Logs and Terminal beside it under Where it runs):
#2).Coding agents pass container to get_logs and search_logs the same way.
A server starts an extra container only while it has the memory for one. When every server a service is placed on in a region wants more containers than it has memory for, and has for half a minute, another server in that region with room runs it too:
Services with a volume and private services run one container per instance and are never added to.
Services with a volume and private services run one container per instance; a service with a volume runs one instance, where its data is.
During a deploy, the new version starts as many containers as are running now before it takes over, and with several instances one server switches first.