Patterns
System Design Patterns, grouped by the job they do.
Five groups, one per job. Every pattern shows where it's actually used - the breakdowns it appears in and the companies running it. Nothing is listed without a real system behind it.
Category
Showing 52 of 52 patterns across 5 categories.
Resilience
25 PATTERNS · 73 USESSurviving failure — containing it, shedding around it, retrying through it, recovering from it.
Fault Isolation14 BREAKDOWNS
Fault isolation means putting boundaries between the parts of a system so that when one part fails, the damage stays contained instead of spreading to everything else.SEEN AT AIRBNB · AMAZON (AWS) · CLOUDFLARE · DATADOG +9Priority-Aware Load Shedding7 BREAKDOWNS
When a system is overloaded and has to turn work away, drop the least important requests first, so the critical ones keep flowing instead of failing along with everything else.SEEN AT AMAZON (AWS) · DOORDASH · LINKEDIN · NETFLIX +3Universal Staged Rollout6 BREAKDOWNS
Universal staged rollout means every change - not just code, but config and auto-updates - rolls out gradually, so a bad one is caught early instead of hitting all the application servers at once.SEEN AT CANVA · DATADOG · DOORDASH · GITLAB +2Retry with Backoff and Jitter4 BREAKDOWNS
Retry with backoff and jitter means when a call fails, each retry waits a bit longer and a bit randomly, so a wave of retries doesn't hit a struggling server all at once.SEEN AT AIRBNB · AMAZON (AWS) · SEGMENT · STRIPEAtomic Phases3 BREAKDOWNS
Atomic phases means splitting a long job into steps that each save their result when they finish, so an interrupted job resumes from the last finished step instead of starting over or repeating work.SEEN AT AIRBNB · AMAZON (AWS)Cell Architecture3 BREAKDOWNS
Cell architecture splits a system into independent copies called cells, each serving some customers on its own, so a failure stays inside one cell and you grow by adding cells, not by enlarging one.SEEN AT DISCORD · SHOPIFY · SLACKCircuit Breaker3 BREAKDOWNS
A circuit breaker watches the calls to a dependency and, once too many fail, stops sending calls and fails them instantly for a while, so a down dependency can't tie up the whole system.SEEN AT DOORDASH · META · SHOPIFYDurable Workflows3 BREAKDOWNS
A durable workflow lets you write a multi-step process as plain top-to-bottom code, while the system saves each step as it finishes, so a crash resumes from the last completed step, not the start.SEEN AT AIRBNB · NETFLIX · UBEREmbedded vs Centralized Orchestration3 BREAKDOWNS
Embedded vs centralized orchestration is where coordination lives: inside each service as a library (isolated, but hard to span services), or in one shared cluster (easy, but a single point of failure).SEEN AT AIRBNB · NETFLIX · UBERGeneric Mitigation3 BREAKDOWNS
A generic mitigation is a safe, reversible action that reduces the damage for many kinds of failure, so you can apply it before you even know what caused the incident.SEEN AT CLOUDFLARE · SHOPIFY · SLACKLogical–Physical Migration Split3 BREAKDOWNS
Split a high-risk storage or topology migration into two phases with different rollback costs.SEEN AT AIRBNB · FIGMA · GITHUBQueue with Guaranteed Delivery3 BREAKDOWNS
A queue with guaranteed delivery persists messages durably until they have been successfully consumed and acknowledged.SEEN AT DISCORD · META · SLACKConservative Auto-Remediation2 BREAKDOWNS
When an automatic recovery action is expensive, destructive, or hard to reverse, gate its trigger on evidence proportional to that cost — and treat elapsed time as evidence: a brief ambiguity should not be allowed to fire an hours-long cure.SEEN AT CLOUDFLARE · SLACKLayered Admission Control2 BREAKDOWNS
Protect a service with a stack of admission mechanisms rather than one: preventative per-client rate limiters in front (pacing fairness on normal days, firing constantly and cheaply), reactive whole-system load shedders behind (deciding under emergency which work deserves the capacity that remains, firing rarely).SEEN AT AMAZON (AWS) · STRIPELoad-Bearing Cache2 BREAKDOWNS
A cache begins life as an optimization: the system works without it, just slower.SEEN AT REDDIT · SLACKRetry Budget2 BREAKDOWNS
Bound retry amplification mechanically by giving each client a local budget — typically a token bucket — that retries spend.SEEN AT AMAZON (AWS) · LINKEDINRetryable Error Classification2 BREAKDOWNS
Partition every failure a request can produce into retryable (presumed transient — infrastructure and network faults; a later identical attempt may succeed) and non-retryable (deterministic — validation and state errors; every identical attempt will fail the same way), and make the classification part of the response contract so clients and frameworks know mechanically whether re-attempting under the same idempotency key is permitted.SEEN AT AIRBNB · AMAZON (AWS)Choreography vs Orchestration1 BREAKDOWN
Two ways to coordinate a multi-service process: choreography, where each service consumes events and emits the next with no component owning the whole, and orchestration, where an engine owns the process definition and drives participants through it.SEEN AT NETFLIXDatabase-as-a-Queue1 BREAKDOWN
When a delivery buffer needs richer access than push and pop — per-tenant isolation, reordering around failures, selective retry, priority changes — store jobs as rows in a relational database and make delivery order a query.SEEN AT SEGMENTDead Letter Queue1 BREAKDOWN
Give the processing path an explicit route for declared failures: a message that cannot be processed — after retries, or on a non-transient error — is negatively acknowledged and persisted to a separate queue or topic, and the main flow's progress marker passes over it.SEEN AT UBERDeadline Propagation1 BREAKDOWN
Have clients attach a timeout hint to every request — how long they are willing to wait — and propagate the remaining time transitively across every hop of the call graph, so each downstream service knows whether its answer can still be useful.SEEN AT AMAZON (AWS)No Uncommitted Config1 BREAKDOWN
Every system accumulates configuration that lives outside its code: settings applied by hand, state managed through a vendor's CLI that bypasses the normal API, decisions made in a console years ago by people who have since left.SEEN AT REDDITRehearsed Restore1 BREAKDOWN
Backups are taken constantly and restores almost never — so the two halves of the capability age at different rates.SEEN AT REDDITShuffle Sharding1 BREAKDOWN
Assign each customer (or tenant, or resource) a virtual shard: a random combination of k workers drawn from a fleet of n, instead of a fixed physical shard.SEEN AT AMAZON (AWS)Throttled Readmission1 BREAKDOWN
After an extended outage, reintroduce load in small, controlled increments rather than reopening the gates — admitting a percentage of users or traffic at a time (via DNS steering, load-balancer weights, or feature gates), verifying key health signals at each step, and holding or backing off if they degrade.SEEN AT ROBLOXThroughput
14 PATTERNS · 25 USESGetting past a limit — sharding data and splitting work so that one machine's limit doesn't define the system's limit.
Feedback-Controlled Load Management5 BREAKDOWNS
Static limits are perpetually wrong.SEEN AT DOORDASH · LINKEDIN · NETFLIX · STRIPE +1Application-Layer Sharding4 BREAKDOWNS
Application-layer sharding moves the decision of where data lives — which shard, which cluster, which storage node — into the application code that reads and writes the data, rather than relying on the underlying storage system's internal sharding.SEEN AT DISCORD · FIGMA · NOTION · PINTERESTSingle-Writer Ownership3 BREAKDOWNS
Assign each data store exactly one writer process, enforced by a mutual-exclusion lease (a Consul session, a fencing token), so that all caching, locking, and invalidation collapse into that process's local state.SEEN AT SEGMENT · SLACKDistributed Metadata Model2 BREAKDOWNS
Every storage or data system has a bookkeeping layer — the metadata plane that knows what exists, who may touch it, and where the pieces live — and every operation consults it.SEEN AT GOOGLEShared-Pool Multiplexing2 BREAKDOWNS
Siloed provisioning wastes capacity by construction: each workload's dedicated storage must be sized for that workload's peak, so every valley — every off-peak hour, every idle weekend — is bought and unused, multiplied by the number of silos.SEEN AT GOOGLEBatched Routing by Destination1 BREAKDOWN
Batched routing by destination is a strategy for issuing bulk operations against partitioned downstream systems without paying the fanout cost of cross-partition batches.SEEN AT DISCORDDurable Front Buffer1 BREAKDOWN
Put a durable, cheap-to-append log in front of a fragile or capacity-bounded processing tier, and admit work from the log into that tier at a controlled rate.SEEN AT SLACKFetch-Execute Decoupling1 BREAKDOWN
Partition-ordered logs (Kafka and its kin) couple two things that have no business being coupled: the order in which messages are fetched and the order in which they finish executing.SEEN AT DOORDASHHibernation vs Polling1 BREAKDOWN
When a process needs to wait for an external signal — a callback, an approval, a scheduled time, a state change in another system — there are two ways to handle the wait.SEEN AT AIRBNBHot-Data-First Migration1 BREAKDOWN
Order a live data migration by access recency and frequency rather than by key range or table order: replicate the hot set — recently created, updated, and read entities — ahead of the archive, so the strained source system sheds its serving load as early as possible and the destination becomes useful long before the migration completes.SEEN AT CANVAID-Encoded Placement1 BREAKDOWN
Embed an object's storage location directly in its identifier — shard bits, type bits, local row bits packed into one integer — so that finding any object is arithmetic every client can perform, with no lookup service, directory tier, or hash ring on the read path.SEEN AT PINTERESTSelective Acknowledgment1 BREAKDOWN
When a substrate's only durable notion of progress is a contiguous watermark — a commit offset, a sequence number — but work items complete out of order, track per-item acknowledgments in a ledger above the substrate and advance the durable watermark only through contiguous acknowledged ranges.SEEN AT UBERSharding Behind a Proxy1 BREAKDOWN
Move shard placement and routing out of the application and into a datastore-owned tier — a query proxy that speaks the database's own protocol, backed by a topology service that tracks where every slice of data lives.SEEN AT SLACKSimulated Policy Selection1 BREAKDOWN
When a system must choose among competing policies — what to cache, where to place data, how long to retain it, when to admit or evict — and the right answer varies by workload, the common failure is picking one policy in a design review and letting it govern everything.SEEN AT GOOGLEConsistency
9 PATTERNS · 16 USESMaking things happen exactly once — and keeping every copy of the truth in agreement.
Idempotency Keys6 BREAKDOWNS
A client-supplied stable identifier that the server uses to deduplicate retries of the same logical operation.SEEN AT AIRBNB · AMAZON (AWS) · SEGMENT · SHOPIFY +1Master-Only Reads2 BREAKDOWNS
Serve every production read from the primary; replicas exist for failover, backups, and offline export, never for traffic.SEEN AT AIRBNB · PINTERESTShard-Key Colocation2 BREAKDOWNS
When sharding, place every row that must be read or committed together on the same shard, by two coordinated choices: shard the full set of tables that reference each other (not just the big one), and partition them all by the same key — the entity whose boundary matches the application's transaction and query patterns.SEEN AT FIGMA · NOTIONCompile-Time Boundary Enforcement1 BREAKDOWN
Declare an architectural boundary as data, then enforce it with automated checks that fail the build — or flag the violation in development — whenever code crosses it.SEEN AT GITHUBContent-Free Change Events1 BREAKDOWN
When replicating or synchronizing data from a source of truth into a derived store, emit events that carry only the identity of what changed — never the changed content.SEEN AT CANVADesignated Source of Truth1 BREAKDOWN
When an operation must update several systems that share no transaction — a local store, a durable log, an acknowledgment to an upstream — a crash between any two updates leaves them disagreeing, and distributed atomicity is expensive or unavailable.SEEN AT SEGMENTLoose Foreign Keys1 BREAKDOWN
When a table boundary hardens into a database boundary — decomposition, sharding, service extraction — foreign keys across the line must die, but the semantics they enforced (cascading DELETE, cascading NULLIFY) still need to hold.SEEN AT GITLABReplica-Promotion Split1 BREAKDOWN
To move a set of tables onto their own database, build a replica of the source, prepare the world around it (reads, pipelines, and join elimination), then quiesce writes to the affected tables, verify replication has fully drained, and promote the replica to an independent master.SEEN AT AIRBNBViolation Ratchet1 BREAKDOWN
When establishing a new architectural invariant across a large, actively evolving codebase — no cross-database joins, no cross-store transactions, no direct use of a deprecated base class — a one-time cleanup loses to the codebase's own velocity: uninvolved engineers introduce new violations faster than a dedicated team removes old ones.SEEN AT GITLABObservability
3 PATTERNS · 5 USESKnowing what's happening — even while the thing you're watching is failing.
Independent Observability3 BREAKDOWNS
Run a monitoring path that shares as little as possible with the system it watches - separate infrastructure, separate dependencies, separate assumptions - so that the failure being detected cannot also disable the detection.SEEN AT AIRBNB · DATADOG · ROBLOXDead Man's Switch1 BREAKDOWN
A Dead Man's Switch detects failure by monitoring the absence of an expected health signal, rather than by detecting the presence of a failure signal.SEEN AT AIRBNBKnown-Answer Testing1 BREAKDOWN
When a failure mode produces no passive signal — no log line, no error counter, no failed health check — because the failing component doesn't know it's failing, detection must be manufactured: inject inputs whose correct outputs are predetermined, execute them on the component under suspicion, and treat any disagreement between produced and expected answers as the detection event.SEEN AT METAPerformance
1 PATTERN · 1 USESMaking the fast path faster — placement and policy chosen on evidence.