Counting in users is just nonsensical. Is it total registered users? Users per <time interval>? Sessions that need to go in the session store? Concurrent requests?

Then there's the implementation language category. interpreted, JITed vs. AOT.

And of course the workload matters a lot. Simple CRUD application vs. compute-heavy or serving lots of media, ...

Together those factors can make like 6+ OOMs difference.