Patterns
System Design Patterns, grouped by the job they do.
Five groups, one per job. Every pattern shows where it's actually used - the breakdowns it appears in and the companies running it. Nothing is listed without a real system behind it.
Category
Showing 52 of 52 patterns across 5 categories.
Resilience
25 PATTERNS · 73 USESSurviving failure — containing it, shedding around it, retrying through it, recovering from it.
Fault Isolation14 BREAKDOWNS
Fault isolation means putting boundaries between the parts of a system so that when one part fails, the damage stays contained instead of spreading to everything else.SEEN AT AIRBNB · AMAZON (AWS) · CLOUDFLARE · DATADOG +9Priority-Aware Load Shedding7 BREAKDOWNS
When a system is overloaded and has to turn work away, drop the least important requests first, so the critical ones keep flowing instead of failing along with everything else.SEEN AT AMAZON (AWS) · DOORDASH · LINKEDIN · NETFLIX +3Universal Staged Rollout6 BREAKDOWNS
Universal staged rollout means every change - not just code, but config and auto-updates - rolls out gradually, so a bad one is caught early instead of hitting all the application servers at once.SEEN AT CANVA · DATADOG · DOORDASH · GITLAB +2Retry with Backoff and Jitter4 BREAKDOWNS
Retry with backoff and jitter means when a call fails, each retry waits a bit longer and a bit randomly, so a wave of retries doesn't hit a struggling server all at once.SEEN AT AIRBNB · AMAZON (AWS) · SEGMENT · STRIPEAtomic Phases3 BREAKDOWNS
Atomic phases means splitting a long job into steps that each save their result when they finish, so an interrupted job resumes from the last finished step instead of starting over or repeating work.SEEN AT AIRBNB · AMAZON (AWS)Cell Architecture3 BREAKDOWNS
Cell architecture splits a system into independent copies called cells, each serving some customers on its own, so a failure stays inside one cell and you grow by adding cells, not by enlarging one.SEEN AT DISCORD · SHOPIFY · SLACKCircuit Breaker3 BREAKDOWNS
A circuit breaker watches the calls to a dependency and, once too many fail, stops sending calls and fails them instantly for a while, so a down dependency can't tie up the whole system.SEEN AT DOORDASH · META · SHOPIFYDurable Workflows3 BREAKDOWNS
A durable workflow lets you write a multi-step process as plain top-to-bottom code, while the system saves each step as it finishes, so a crash resumes from the last completed step, not the start.SEEN AT AIRBNB · NETFLIX · UBEREmbedded vs Centralized Orchestration3 BREAKDOWNS
Embedded vs centralized orchestration is where coordination lives: inside each service as a library (isolated, but hard to span services), or in one shared cluster (easy, but a single point of failure).SEEN AT AIRBNB · NETFLIX · UBERGeneric Mitigation3 BREAKDOWNS
A generic mitigation is a safe, reversible action that reduces the damage for many kinds of failure, so you can apply it before you even know what caused the incident.SEEN AT CLOUDFLARE · SHOPIFY · SLACKLogical–Physical Migration Split3 BREAKDOWNS
Do a risky migration in two steps: first make the system act as if the data has already moved (mistakes revert in seconds), then actually move it, the step you can't easily revert.SEEN AT AIRBNB · FIGMA · GITHUBQueue with Guaranteed Delivery3 BREAKDOWNS
A queue with guaranteed delivery saves every message until it has been processed and confirmed, so it survives backlogs and crashes without dropping anything - unlike a buffer, which loses messages under pressure.SEEN AT DISCORD · META · SLACKConservative Auto-Remediation2 BREAKDOWNS
Before an expensive automatic fix fires, we need evidence that it is actually worth its cost and time. A brief blip should not trigger an automatic costly cure.SEEN AT CLOUDFLARE · SLACKLayered Admission Control2 BREAKDOWNS
Guard a service with several layers that decide which requests to let in: cheap per-client rate limiters in front that fire all the time, and whole-system load shedders behind that fire only in emergencies.SEEN AT AMAZON (AWS) · STRIPELoad-Bearing Cache2 BREAKDOWNS
When a database can handle only the reads its cache misses, losing the cache can take the system down, not just slow it: every read it was answering now hits the database at once.SEEN AT REDDIT · SLACKRetry Budget2 BREAKDOWNS
Each client gets a small number of retry tokens that build back up slowly, so a failing service gets only a little extra load instead of every client piling on to keep it down.SEEN AT AMAZON (AWS) · LINKEDINRetryable Error Classification2 BREAKDOWNS
Sort every error into safe to retry or not, put that label in the response, and clients will retry the temporary faults and give up fast on the ones that would just fail again.SEEN AT AIRBNB · AMAZON (AWS)Choreography vs Orchestration1 BREAKDOWN
Two ways to run a process that spans several services: let each service react to the previous one's event with no one in charge, or let one engine own the steps and direct each service.SEEN AT NETFLIXDatabase-as-a-Queue1 BREAKDOWN
When a delivery buffer needs richer access than push and pop — per-tenant isolation, reordering around failures, selective retry, priority changes — store jobs as rows in a relational database and make delivery order a query.SEEN AT SEGMENTDead Letter Queue1 BREAKDOWN
Give the processing path an explicit route for declared failures: a message that cannot be processed — after retries, or on a non-transient error — is negatively acknowledged and persisted to a separate queue or topic, and the main flow's progress marker passes over it.SEEN AT UBERDeadline Propagation1 BREAKDOWN
Have clients attach a timeout hint to every request — how long they are willing to wait — and propagate the remaining time transitively across every hop of the call graph, so each downstream service knows whether its answer can still be useful.SEEN AT AMAZON (AWS)No Uncommitted Config1 BREAKDOWN
Every system accumulates configuration that lives outside its code: settings applied by hand, state managed through a vendor's CLI that bypasses the normal API, decisions made in a console years ago by people who have since left.SEEN AT REDDITRehearsed Restore1 BREAKDOWN
Backups are taken constantly and restores almost never — so the two halves of the capability age at different rates.SEEN AT REDDITShuffle Sharding1 BREAKDOWN
Assign each customer (or tenant, or resource) a virtual shard: a random combination of k workers drawn from a fleet of n, instead of a fixed physical shard.SEEN AT AMAZON (AWS)Throttled Readmission1 BREAKDOWN
After an extended outage, reintroduce load in small, controlled increments rather than reopening the gates — admitting a percentage of users or traffic at a time (via DNS steering, load-balancer weights, or feature gates), verifying key health signals at each step, and holding or backing off if they degrade.SEEN AT ROBLOXThroughput
14 PATTERNS · 25 USESGetting past a limit — sharding data and splitting work so that one machine's limit doesn't define the system's limit.
Feedback-Controlled Load Management5 BREAKDOWNS
A fixed limit on how much load to accept is wrong as capacity varies, so a feedback loop watches a live signal and adjusts the load limit dynamically.SEEN AT DOORDASH · LINKEDIN · NETFLIX · STRIPE +1Application-Layer Sharding4 BREAKDOWNS
Application-layer sharding puts the decision of sharding (which machine each piece of data lives on) into your application code, instead of the underlying storage system splitting the data across machines.SEEN AT DISCORD · FIGMA · NOTION · PINTERESTSingle-Writer Ownership3 BREAKDOWNS
Let just one process write to each database (or shard), so that owner keeps everything it wrote in its own memory and never coordinates with other writers.SEEN AT SEGMENT · SLACKDistributed Metadata Model2 BREAKDOWNS
A system's bookkeeping layer - the part that tracks where the data lives - can quietly limit how big the whole system can grow, so this pattern rebuilds it on a scalable database.SEEN AT GOOGLEShared-Pool Multiplexing2 BREAKDOWNS
Giving each workload its own storage means paying for every peak separately, so create one shared storage pool where background work runs whenever the busy workloads are idle.SEEN AT GOOGLEBatched Routing by Destination1 BREAKDOWN
Batched routing by destination is a strategy for issuing bulk operations against partitioned downstream systems without paying the fanout cost of cross-partition batches.SEEN AT DISCORDDurable Front Buffer1 BREAKDOWN
Put a durable, cheap-to-append log in front of a fragile or capacity-bounded processing tier, and admit work from the log into that tier at a controlled rate.SEEN AT SLACKFetch-Execute Decoupling1 BREAKDOWN
Partition-ordered logs (Kafka and its kin) couple two things that have no business being coupled: the order in which messages are fetched and the order in which they finish executing.SEEN AT DOORDASHHibernation vs Polling1 BREAKDOWN
When a process needs to wait for an external signal — a callback, an approval, a scheduled time, a state change in another system — there are two ways to handle the wait.SEEN AT AIRBNBHot-Data-First Migration1 BREAKDOWN
Order a live data migration by access recency and frequency rather than by key range or table order: replicate the hot set — recently created, updated, and read entities — ahead of the archive, so the strained source system sheds its serving load as early as possible and the destination becomes useful long before the migration completes.SEEN AT CANVAID-Encoded Placement1 BREAKDOWN
Embed an object's storage location directly in its identifier — shard bits, type bits, local row bits packed into one integer — so that finding any object is arithmetic every client can perform, with no lookup service, directory tier, or hash ring on the read path.SEEN AT PINTERESTSelective Acknowledgment1 BREAKDOWN
When a substrate's only durable notion of progress is a contiguous watermark — a commit offset, a sequence number — but work items complete out of order, track per-item acknowledgments in a ledger above the substrate and advance the durable watermark only through contiguous acknowledged ranges.SEEN AT UBERSharding Behind a Proxy1 BREAKDOWN
Move shard placement and routing out of the application and into a datastore-owned tier — a query proxy that speaks the database's own protocol, backed by a topology service that tracks where every slice of data lives.SEEN AT SLACKSimulated Policy Selection1 BREAKDOWN
When a system must choose among competing policies — what to cache, where to place data, how long to retain it, when to admit or evict — and the right answer varies by workload, the common failure is picking one policy in a design review and letting it govern everything.SEEN AT GOOGLEConsistency
9 PATTERNS · 16 USESMaking things happen exactly once — and keeping every copy of the truth in agreement.
Idempotency Keys6 BREAKDOWNS
A unique label the client attaches to a request, so the server tells a retry from a new request and does the work only once, no matter how often the same request is retried.SEEN AT AIRBNB · AMAZON (AWS) · SEGMENT · SHOPIFY +1Master-Only Reads2 BREAKDOWNS
Send every read to the primary database, never to a replica (a copy that lags behind it), so no read is ever stale - replicas exist only for failover and backups.SEEN AT AIRBNB · PINTERESTShard-Key Colocation2 BREAKDOWNS
When you shard a database across machines, keep data that is used together on the same machine, by sharding all the related tables by one shared key - like the user or workspace.SEEN AT FIGMA · NOTIONCompile-Time Boundary Enforcement1 BREAKDOWN
Declare an architectural boundary as data, then enforce it with automated checks that fail the build — or flag the violation in development — whenever code crosses it.SEEN AT GITHUBContent-Free Change Events1 BREAKDOWN
When replicating or synchronizing data from a source of truth into a derived store, emit events that carry only the identity of what changed — never the changed content.SEEN AT CANVADesignated Source of Truth1 BREAKDOWN
When an operation must update several systems that share no transaction — a local store, a durable log, an acknowledgment to an upstream — a crash between any two updates leaves them disagreeing, and distributed atomicity is expensive or unavailable.SEEN AT SEGMENTLoose Foreign Keys1 BREAKDOWN
When a table boundary hardens into a database boundary — decomposition, sharding, service extraction — foreign keys across the line must die, but the semantics they enforced (cascading DELETE, cascading NULLIFY) still need to hold.SEEN AT GITLABReplica-Promotion Split1 BREAKDOWN
To move a set of tables onto their own database, build a replica of the source, prepare the world around it (reads, pipelines, and join elimination), then quiesce writes to the affected tables, verify replication has fully drained, and promote the replica to an independent master.SEEN AT AIRBNBViolation Ratchet1 BREAKDOWN
When establishing a new architectural invariant across a large, actively evolving codebase — no cross-database joins, no cross-store transactions, no direct use of a deprecated base class — a one-time cleanup loses to the codebase's own velocity: uninvolved engineers introduce new violations faster than a dedicated team removes old ones.SEEN AT GITLABObservability
3 PATTERNS · 5 USESKnowing what's happening — even while the thing you're watching is failing.
Independent Observability3 BREAKDOWNS
Watch a system from a separate, independent path that shares as little as possible with it, so that whatever takes the system down cannot take down the monitoring with it.SEEN AT AIRBNB · DATADOG · ROBLOXDead Man's Switch1 BREAKDOWN
Detect failure by watching the system's steady 'I am alive' heartbeat, and raising the alert when that heartbeat stops - because a system that has died silently cannot report anything.SEEN AT AIRBNBKnown-Answer Testing1 BREAKDOWN
Catch a component that is silently returning wrong answers by testing it with inputs whose correct answers are known, and treating any mismatch as the failure it will never report itself.SEEN AT METAPerformance
1 PATTERN · 1 USESMaking the fast path faster — placement and policy chosen on evidence.