System Design cheat sheet

1. Requirements (5-8 min): 3-5 use cases, measurable non-functional needs (scale, latency, availability, consistency), what is out of scope.
2. Estimation (3-5): average and peak QPS, storage, bandwidth, cache. End with "so this means...".
3. API and data (5-8): endpoints or events, entities, access patterns, storage choice, IDs.
4. High-level design (10-15): client, DNS/CDN, LB, gateway, services, cache / DB / storage / queue. Walk each use case through it.
5. Deep dives (10-15): bottlenecks, failures, consistency, hot keys, security, monitoring.
6. Wrap-up (2-5): trade-offs, risks, next steps.

Tip: Start simple, put numbers on everything, say each trade-off out loud, and never stay silent.

1 day

86,400 s, call it 100k

1 month / 1 year

~2.6M s / ~31.5M s

1M requests/day

~12 per second

Peak

2-10x average (3x if unsure)

One app server

hundreds to a few thousand req/s

One SQL DB / one Redis

1k-10k+ queries/s / ~100k ops/s

Avg QPS  = requests/day / 86,400
Storage  = items/day x size x years
Bandwidth= QPS x response size
Servers  = peak QPS / QPS per server
           (+ headroom)
Little   = in flight = rate x time
Avail.   = MTBF / (MTBF + MTTR)
Series   = A x B x C (lower)
Parallel = 1 - (1-A)(1-B)
Quorum   = W + R > N
Base62   = 62^len (6: 56.8B, 7: 3.5T)

Tip: Use p99, not averages: the slow tail is common at scale. Three 99.9% services in series give ~99.7%. Faster recovery (MTTR) is the cheapest nine.

• Algorithms: round robin, least connections, power of two choices, consistent hashing. Keep health checks shallow.
• GET, PUT, DELETE are idempotent, POST is not. 502 bad gateway, 503 unavailable, 504 gateway timeout. TLS 1.3 takes 1 round trip.
• API gateway = reverse proxy plus auth, rate limits, routing. BFF = one API per client type.
• CDN: Cache-Control sets lifetime, hashed file names avoid stale files, an origin shield protects the origin.

• Cache-aside is the safe default: read cache, load on miss and fill, delete the key on write, TTL on everything.
• Hit ratio 95% to 99% cuts backend load 5x. Evict with LRU or LFU. Read critical values (price at checkout, balance) from the source.

Watch out: Lost update and write skew need UPDATE ... SET x = x - 1 WHERE x > 0, FOR UPDATE, a unique constraint, or Serializable plus retry.

• Multi-column index helps only from its left prefix. Check with EXPLAIN ANALYZE. Fix N+1 with a join.
• Replication (availability, read scale): async is fast but can lose writes and lag. Read your own writes from the leader.
• Sharding (write scale, size): range, hash, directory or geo. A good shard key is even, matches queries, rarely changes.
• hash % N moves most keys. Consistent hashing (ring plus virtual nodes) moves ~1/N.

Watch out: Replication is not a backup: replicas copy deletes and corruption at once.

• In a partition you pick consistency (refuse) or availability (answer, maybe stale). PACELC: otherwise, latency or consistency.
• Choose consistency for money, stock, uniqueness. Choose availability for feeds, likes, catalogues.

• Idempotency key: unique constraint plus saved response, so a retried POST does not charge twice.
• Cursor pagination stays stable as data changes; offset only for small lists. Add fields, never break clients.

• Queue: one consumer gets each message. Pub/sub: every subscriber gets a copy.
• Kafka: the key picks the partition, order holds only within one. One consumer per partition per group. Watch lag. Use acks=all.
• Outbox fixes the dual write (DB updated, event lost). Failing jobs: transient retries only, then a DLQ.

delay = random(0,
  min(cap, base * 2^attempt))

• Timeout on every call. Retry only transient, idempotent errors, 2-3 attempts, at one layer (attempts multiply per layer).
• Circuit breaker: closed, open (fail fast), half-open (test calls). Bulkhead = separate pools. Shed load with 503 + Retry-After.

Tip: Share counters in Redis with an atomic Lua script. Return 429 + Retry-After. Fail open for general limits, closed for login and OTP.

• Backups: 3-2-1 rule, immutable copies, PITR (base backup + WAL), test restores.
• SLI = good events / valid events. SLO = target. SLA = looser promise. Error budget = 1 - SLO.
• Burn rate 14.4x (1.44% errors vs 0.1% allowed) spends the 30-day budget in ~2 days: page. Alert on symptoms.
• Golden signals: latency, traffic, errors, saturation. Logs say what, metrics say how much, traces say where.

• AuthN is who you are, AuthZ is what you may do. Hash passwords with Argon2id or bcrypt; offer MFA or passkeys.
• Cookies: HttpOnly; Secure; SameSite. JWTs are signed, not encrypted: pin the algorithm, check exp/aud/iss, short life, rotating refresh.
• OAuth: Auth Code + PKCE for users, Client Credentials for services. OIDC adds the ID token for login.

• Monolith first, then modular monolith, then microservices when teams demand it. Migrate with the strangler fig. Avoid the distributed monolith.
• Containers: version tags (not latest), non-root, no secrets. Kubernetes: readiness vs liveness, requests/limits, spread across 3 zones (150% of peak).

Tip: Feature flags separate deploy from release. Change schemas with expand-and-contract.

Tip: Shortener: 100M new/month is ~40 writes/s and ~3,800 reads/s (100:1); 12B URLs fit in 7 Base62 characters.