System Design, Step by Step

A blog series

System Design, Step by Step

Learn how real systems are built, one idea at a time. Start with what happens when you press Enter, then work through scaling, caching, databases, queues, reliability and security, and finish by designing a URL shortener, a chat app and a news feed. Every short form is explained when you hover over it, and every idea comes with a diagram.

Started 
2026
Progress 
69 / 69 lessons
Parts 
12
Reading 
~12 h

How the series is organised

Twelve parts, each building on the one before. Jump to any part, or start at Lesson 01 and read in order.

  1. 1Foundations Before System DesignHow the internet, HTTP, the OS and SQL actually work — the ground everything else stands on.Lessons 1–5
  2. 2System Design Core ConceptsRequirements, scaling, latency, availability and the maths you do on the back of an envelope.Lessons 6–10
  3. 3The Building BlocksLoad balancers, proxies, CDNs, caches, object storage, queues and search — the Lego bricks of every design.Lessons 11–19
  4. 4Databases & Data at ScaleSQL vs NoSQL, transactions, indexes, replication, sharding, CAP and consistency.Lessons 20–29
  5. 5APIs & CommunicationREST, gRPC, GraphQL, real-time connections, and the API habits that keep clients safe.Lessons 30–34
  6. 6Async & Event-Driven SystemsQueues, pub/sub, Kafka, delivery guarantees, background jobs and events.Lessons 35–39
  7. 7Reliability & ResilienceRedundancy, retries, circuit breakers, rate limits, load shedding and disaster recovery.Lessons 40–45
  8. 8ObservabilityLogs, metrics, traces, SLOs, alerting and blameless postmortems.Lessons 46–48
  9. 9Security for System DesignersAuthentication, OAuth, encryption, secrets and the OWASP Top 10.Lessons 49–52
  10. 10Architecture & DeploymentMonoliths, microservices, containers, Kubernetes, the cloud and shipping safely.Lessons 53–58
  11. 11Design It Yourself: Case StudiesA repeatable framework, then URL shorteners, rate limiters, notifications, chat and news feeds.Lessons 59–65
  12. 12Wrap-Up & ReferenceThe conclusion, a glossary of every short form, the full architecture in one picture, and a cheat sheet.Lessons 66–69

Contents

Part 1 · Foundations Before System Design

How the internet, HTTP, the OS and SQL actually work — the ground everything else stands on.

  1. Lesson 01What Happens When You Type a URL and Press Enter?The one second between pressing Enter and seeing a page hides a DNS lookup, a trip through a dozen routers, two handshakes and a server doing real work. Every later lesson zooms into one part of that journey.10 min
  2. Lesson 02TCP vs UDP: How Data Actually TravelsThe internet loses, duplicates and reorders packets. TCP promises every byte in order and pays for it in round trips; UDP just sends and lets the app cope. How each works, and how QUIC takes the best of both.8 min
  3. Lesson 03HTTP & HTTPS Explained: Methods, Status Codes and TLSHTTP is the shared language of the web: a method and URL in, a status code and body out. HTTPS wraps it in TLS so nobody on the path can read or change it. Methods, idempotency, status codes, HTTP/1.1 vs 2 vs 3, and the TLS handshake.12 min
  4. Lesson 04Processes, Threads & Concurrency for Backend EngineersMost backend work is waiting. How one server juggles thousands of requests — processes, threads, event loops and lightweight threads — and the race conditions, deadlocks and pool limits that appear the moment it does.12 min
  5. Lesson 05SQL Basics Every System Designer NeedsBefore sharding, replicas or NoSQL, learn to use one relational database well. Tables and keys, the queries you will write every day, indexes and EXPLAIN, the N+1 trap, transactions, and the connection limit that takes databases down.10 min

Part 2 · System Design Core Concepts

Requirements, scaling, latency, availability and the maths you do on the back of an envelope.

  1. Lesson 06What Is System Design? Start With RequirementsTwo teams build the same app; one collapses on launch day. The difference is not coding skill but system design — and good design always starts with requirements you can measure.8 min
  2. Lesson 07Vertical vs Horizontal Scaling (and Why Stateless Wins)Bigger server or more servers? Vertical scaling is simple but hits a ceiling; horizontal scaling is nearly unlimited, but only once your app forgets everything between requests. Why stateless wins, and where state should live instead.8 min
  3. Lesson 08Latency, Throughput & Why p99 MattersAn 80 ms average can hide a checkout that freezes for five seconds. Latency, throughput and Little's Law, why queues explode near full utilisation, and why at scale the p99 becomes what most users feel.8 min
  4. Lesson 09Availability and "The Nines" Explained“Five nines” is 26 seconds of downtime a month. What the nines really mean, why chained dependencies multiply away your availability while redundancy multiplies it back, and why fast recovery is often the cheapest nine you can buy.8 min
  5. Lesson 10Back-of-the-Envelope Estimation, Step by StepFive minutes of rough maths tells you whether you need one database or fifty. The numbers worth memorising, a seven-step recipe, and a full worked estimate for a photo-sharing app — with a calculator to try your own.12 min

Part 3 · The Building Blocks

Load balancers, proxies, CDNs, caches, object storage, queues and search — the Lego bricks of every design.

  1. Lesson 11Anatomy of a Request: From Browser to DatabaseA system-design diagram looks like a wall of boxes. Follow one request — “show me my order history” — through DNS, CDN, load balancer, gateway, app servers, cache, database and queues, and learn why each box exists.8 min
  2. Lesson 12Load Balancers: L4 vs L7 and Balancing AlgorithmsOne address, many servers, and one of them just crashed at 2 AM. How load balancers spread traffic, L4 vs L7, the balancing algorithms and when each wins, and why a “deep” health check can take everything down at once.10 min
  3. Lesson 13Reverse Proxy vs API GatewayReverse proxy, load balancer and API gateway get used interchangeably — NGINX is called all three. What each one is actually for, where authentication and rate limiting belong, the Backend-for-Frontend pattern, and when a gateway is overkill.8 min
  4. Lesson 14How CDNs Make the Web FastYour servers are in Mumbai and a user in São Paulo waits three seconds. How CDNs copy content to edges near every user, how HTTP headers control what gets cached, and how to update files that live on hundreds of servers.8 min
  5. Lesson 15Caching Part 1: Where to Cache and WhyWhy ask the database the same question 10,000 times a second? What caches are, why they work so well, every layer you can cache at — browser to buffer pool — what to cache, and how Redis and Memcached compare.10 min
  6. Lesson 16Caching Part 2: Strategies, Eviction and InvalidationAdding a cache is easy; keeping it correct is hard. The six read/write strategies, why you delete rather than update on write, eviction policies you can try by hand, invalidation per data type, and the five ways caches cause outages.12 min
  7. Lesson 17Object Storage: How S3-Style Storage WorksImages saved to a server's disk vanish when you add a second server. How S3-style object storage keeps files safe at any scale, why uploads should skip your servers entirely, and what belongs in the database instead.7 min
  8. Lesson 18Message Queues: A Gentle IntroductionPlacing an order shouldn't wait on the email provider — or fail because SMS is down. How message queues let you do the essential work now and everything else reliably a moment later, with acks, retries, dead-letter queues and back pressure.7 min
  9. Lesson 19How Search Works: The Inverted IndexLIKE '%running shoes%' scans every row and still misses “running shoe”. How the inverted index flips documents into term → document lists, how analysis makes search forgiving, how BM25 ranks results, and how search scales and stays in sync.8 min

Part 4 · Databases & Data at Scale

SQL vs NoSQL, transactions, indexes, replication, sharding, CAP and consistency.

  1. Lesson 20SQL vs NoSQL: Picking the Right Data Model“SQL or NoSQL?” is the wrong question; the right one is “what shape is my data, and how will I read and write it?” The relational model and the four NoSQL families — key-value, document, wide-column and graph — what each is good at, the myths to drop, and a sensible default.12 min
  2. Lesson 21ACID Transactions & Isolation LevelsTwo people book the last seat; a transfer crashes halfway. What ACID really promises, the write-ahead log behind durability, the five anomalies isolation levels do (and don't) prevent, and the practical fixes for real race conditions.12 min
  3. Lesson 22Database Indexing: B-Trees and LSM-TreesWhy an index turns 812 ms into 0.09 ms, and why it slows every write. How B-trees keep sorted pages updated in place, how LSM-trees append and compact for huge write rates, and how to design indexes from real queries.12 min
  4. Lesson 23Normalization vs DenormalizationStore each fact once and writes stay correct; copy facts on purpose and reads get fast. Normal forms in plain English, the anomalies they prevent, the denormalisation toolkit, and how to keep copies in sync.7 min
  5. Lesson 24Database Replication: Leader, Follower and BeyondOne database server will eventually die, drown in reads, or be too far from your users. How leader-follower replication works, what replication lag does to real users, why failover is so hard, and how multi-leader and quorum systems handle conflicts.12 min
  6. Lesson 25Sharding: Splitting Data Across MachinesIndexes tuned, biggest server bought, replicas added — and the primary still drowns in writes. How sharding splits one dataset across machines, the four strategies, how to pick a shard key, and the hard problems it creates.12 min
  7. Lesson 26Consistent Hashing, Visually ExplainedAdd a fifth cache server to hash(key) % 4 and 80% of your keys move — the hit ratio collapses and the database falls over. How the hash ring moves only ~1/N of keys, why virtual nodes even out the load, and the alternatives.10 min
  8. Lesson 27CAP Theorem & PACELC Without the Confusion“MongoDB is CP, Cassandra is AP, pick two of three” — mostly misleading. What CAP really says about network partitions, why “CA” isn't a real option, and PACELC: the latency-vs-consistency trade you pay every day, even when nothing is broken.10 min
  9. Lesson 28Consistency Models: Strong, Eventual and In Between“Eventually consistent” can mean your own comment vanishes on refresh. Consistency is a spectrum, not a switch: linearizable, causal, session guarantees and eventual — what each promises, how conflicts get merged, and why clocks can't be trusted.10 min
  10. Lesson 29How to Choose a Database for Your SystemHundreds of databases all claim to be fast and scalable. A practical seven-step process: the questions to ask, a sensible default, the signals that justify something else, prototyping with real load, and migrating safely when you got it wrong.8 min

Part 5 · APIs & Communication

REST, gRPC, GraphQL, real-time connections, and the API habits that keep clients safe.

  1. Lesson 30REST API Design Best PracticesAn API is a contract other teams depend on for years. How to design REST APIs that are predictable: nouns and HTTP methods, honest status codes, one error shape, filtering and pagination, free HTTP features, security basics and OpenAPI.12 min
  2. Lesson 31gRPC & Protocol Buffers for BeginnersForty internal services, dozens of calls per page, JSON everywhere and contracts in a stale wiki. How gRPC and Protocol Buffers give services fast, typed, streaming calls — and the schema-evolution and load-balancing rules you must follow.10 min
  3. Lesson 32GraphQL vs REST: When to Use WhichSix REST calls to draw one profile screen, and most of the data thrown away. How GraphQL lets clients ask for exactly what they need in one request, what that costs the server — N+1, caching, expensive queries — and when to pick REST, GraphQL or gRPC.8 min
  4. Lesson 33Real-Time Apps: Polling, WebSockets and SSEHTTP only lets the client ask. For “new message”, “rider is nearby” or an AI answer streaming in, the server has to push. Short polling, long polling, Server-Sent Events and WebSockets compared — and how to scale millions of open connections.10 min
  5. Lesson 34Idempotency, Pagination & API VersioningA retried payment that charges twice, a list endpoint that loads three million rows, a renamed field that crashes every old app. Idempotency keys, cursor pagination and careful versioning — the unglamorous details that separate a demo API from a production one.10 min

Part 6 · Async & Event-Driven Systems

Queues, pub/sub, Kafka, delivery guarantees, background jobs and events.

  1. Lesson 35Queues vs Pub/Sub“One of you handles this” or “all of you get a copy”? Mix them up and orders go unpacked, or customers get five emails. Queues vs pub/sub, how real systems combine both, push vs pull, per-key ordering, and delete vs keep.8 min
  2. Lesson 36Apache Kafka FundamentalsThirty services all need each other's data, and the data team wants to replay last week. How Kafka's simple idea — a partitioned, replicated, append-only log — became the backbone of event streaming: topics, keys, offsets, consumer groups, retention and compaction.12 min
  3. Lesson 37At-Most-Once, At-Least-Once, Exactly-OnceAcknowledge too early and a crash loses the payment; acknowledge too late and it charges twice. At-most-once, at-least-once and why true exactly-once is impossible — plus idempotent consumers, Kafka's exactly-once and the transactional outbox.8 min
  4. Lesson 38Background Jobs, Retries & Dead-Letter QueuesBackground jobs are easy to start and surprisingly easy to get wrong: poison jobs, retry storms, cron that runs twice, deploys that kill half-done work. How to design jobs, retry only what can succeed, and route what can't to a dead-letter queue you actually watch.10 min
  5. Lesson 39Event-Driven Architecture for BeginnersThe order service calls seven other services and fails whenever any of them does. Event-driven architecture flips it: announce what happened and let whoever cares react. Events vs commands, the four patterns called “event-driven”, choreography vs orchestration, and sagas.8 min

Part 7 · Reliability & Resilience

Redundancy, retries, circuit breakers, rate limits, load shedding and disaster recovery.

  1. Lesson 40Single Points of Failure, Redundancy & FailoverThe site went down, and the culprit was none of the redundant boxes on the diagram but the one NAT gateway, the one DNS provider, or an expired certificate. How to hunt single points of failure, shrink blast radius, add redundancy that works, and fail over without split brain.10 min
  2. Lesson 41Timeouts, Retries & Backoff with JitterOne slow dependency with no timeout, plus clients that retry instantly, can take down an entire site. How to set timeouts from real latency, propagate deadlines, retry only what's safe, avoid retry amplification, and why backoff needs jitter.10 min
  3. Lesson 42Circuit Breaker & Bulkhead PatternsTimeouts limit how long you wait per call, but not how often you keep calling a service you already know is dead. How circuit breakers fail fast and test for recovery, how bulkheads stop one dependency exhausting everything, and how to design honest fallbacks.8 min
  4. Lesson 43Rate Limiting Algorithms ExplainedOne buggy script calling 5,000 times a second can hurt every customer. How rate limiting protects your system and keeps usage fair: the five classic algorithms — with a simulator you can drive — distributed limiting in Redis, and how to tell clients to slow down.12 min
  5. Lesson 44Graceful Degradation & Load SheddingAt 5× your planned peak, trying to serve everyone means serving no one. How to fail partially and on purpose: rank features and switch off the optional ones, reject excess work early and cheaply, shed by priority, and use waiting rooms for spikes you can see coming.8 min
  6. Lesson 45Backups & Disaster Recovery: RPO vs RTOReplication faithfully copies a mistaken DELETE, ransomware or silent corruption to every replica in milliseconds. Why backups are a different thing, how RPO and RTO drive every decision, point-in-time recovery, the 3-2-1 rule, the four DR strategies, and why an untested backup is only a hope.8 min

Part 8 · Observability

Logs, metrics, traces, SLOs, alerting and blameless postmortems.

  1. Lesson 46Logs, Metrics & Traces: The Three Pillars“Checkout took 20 seconds and failed” — but checkout touches eleven components. How logs, metrics and traces each answer a different question, how to instrument with OpenTelemetry, and how linking them takes you from “something's wrong” to “here's why” in minutes.10 min
  2. Lesson 47SLI, SLO, SLA & Error BudgetsProduct wants to ship daily; operations wants fewer changes; nobody agrees what “reliable enough” means. SLIs, SLOs and SLAs turn it into one number, and error budgets turn that number into a simple rule for when to move fast and when to slow down.10 min
  3. Lesson 48Monitoring, Alerting & Blameless PostmortemsSixty alerts a week, fifty-five that don't matter — so the real one gets snoozed and customers can't pay for two hours. How to build dashboards and alerts people trust, run incidents with clear roles, and write blameless postmortems that actually make the system better.8 min

Part 9 · Security for System Designers

Authentication, OAuth, encryption, secrets and the OWASP Top 10.

  1. Lesson 49Authentication vs Authorization: Sessions, Cookies & JWTEvery endpoint checked “is the user logged in?” — and changing one number in the URL showed another customer's invoice. Authentication vs authorization, storing passwords, MFA and passkeys, sessions vs JWTs (with a live token to tamper with), and RBAC, ABAC and ReBAC.12 min
  2. Lesson 50OAuth 2.0 & OpenID Connect ExplainedApps used to ask for your Google password to print your photos. How OAuth 2.0 hands out limited, expiring, revocable “valet keys” instead, how OpenID Connect adds login on top, and the flows and checks that keep it secure.12 min
  3. Lesson 51Encryption & Secrets ManagementUnencrypted traffic “inside our network”, an unencrypted backup in a public bucket, a database password pushed to GitHub. Where to encrypt in transit and at rest, who holds the keys, how envelope encryption and KMS work, end-to-end encryption, and how to store, deliver and rotate secrets.10 min
  4. Lesson 52OWASP Top 10 for Backend DevelopersMost breaches don't need a genius hacker — just a missing ownership check, a string-glued SQL query or a default password. The OWASP Top 10 explained for backend developers, with the attack, the fix and a real incident for each, plus the API-specific risks.10 min

Part 10 · Architecture & Deployment

Monoliths, microservices, containers, Kubernetes, the cloud and shipping safely.

  1. Lesson 53Monolith vs Microservices: An Honest ComparisonA five-person startup with 14 services, and a 300-engineer company with one two-hour deploy — both chose wrong. Monoliths, microservices and the modular monolith in between, how to find boundaries, how to migrate with the strangler fig, and the signals that tell you which fits.12 min
  2. Lesson 54Service Discovery: How Services Find Each OtherA hard-coded IP address is out of date within minutes once containers auto-scale and redeploy all day. How services find the current, healthy addresses of each other: registries, health checks, client-side vs server-side discovery, DNS, service meshes, and shutting down without dropping requests.7 min
  3. Lesson 55Docker & Containers for Beginners“It works on my machine” ends here. What containers really are (and aren't), images, layers and registries, a production-grade multi-stage Dockerfile, running and composing containers locally, tags vs digests, and the security basics.10 min
  4. Lesson 56Kubernetes Core ConceptsRunning 300 containers across 40 machines by hand doesn't work. How Kubernetes turns “what I want” into “what's running”: the control plane and nodes, the reconciliation loop, pods, deployments, services and ingress, health probes, resources and autoscaling — and whether you need it at all.12 min
  5. Lesson 57Cloud Fundamentals: Regions, AZs & ServerlessServers that once took months to order now take minutes — but the cloud has its own concepts, failure modes and surprise bills. Regions and availability zones, IaaS to SaaS, serverless and cold starts, the shared responsibility model, cost, and infrastructure as code.8 min
  6. Lesson 58CI/CD & Deployment Strategies: Blue-Green and CanaryFriday-evening deploys that need three people and a prayer are optional. CI that catches problems before merge, continuous delivery vs deployment, rolling, blue-green and canary releases — with a simulator — feature flags, zero-downtime database migrations and the DORA metrics.10 min

Part 11 · Design It Yourself: Case Studies

A repeatable framework, then URL shorteners, rate limiters, notifications, chat and news feeds.

  1. Lesson 59A 5-Step Framework for Any System Design ProblemA blank whiteboard and “design Instagram” is terrifying without a plan. A five-step framework that works for any system design problem — requirements, estimation, API and data model, high-level design, deep dives — with a worked Pastebin example and the common mistakes to avoid.10 min
  2. Lesson 60Design a URL ShortenerThe classic first case study, end to end. Requirements and estimates, the API and data model, how to generate short codes (hashing vs counters vs Snowflake IDs — with a live base62 encoder), a read path that serves 20,000 redirects a second, 301 vs 302, and click analytics.15 min
  3. Lesson 61Design a Rate LimiterDesigning the rate limiter itself, as a real service: 100,000 requests a second, many rules per request, sub-millisecond checks. Requirements, estimates, a rule model, a Redis-backed gateway design, atomic Lua checks, hot keys, fail-open vs fail-closed, and multi-region.15 min
  4. Lesson 62Design a Notification SystemOTPs that must arrive in seconds, order updates, and a marketing blast to 20 million users in ten minutes — through push, SMS, email and in-app. A full design: API, preferences and templates, priority queues, channel workers, provider fallback, deduplication, rate limits and delivery tracking.15 min
  5. Lesson 63Design a Chat SystemFifty million daily users, ten million online at once, 70,000 messages a second, one-to-one and groups, sent/delivered/read ticks and nothing ever lost. A full chat system design: WebSocket gateways, per-conversation sequence numbers, a wide-column message store, presence, offline push and sync.18 min
  6. Lesson 64Design a News FeedA hundred million users opening a feed ten times a day, and one celebrity post that must reach fifty million followers. A full news-feed design: fan-out on write vs on read, the hybrid that handles celebrities, feed caches, hydration, ranking, pagination and counters.18 min
  7. Lesson 65What I Learned From Big Tech Engineering BlogsInterview designs are clean; real systems are messy, migrated and patched for years. How to read engineering blogs and postmortems so you actually learn from them, the ten lessons that keep repeating across big-tech stories, and a reading list to keep going.10 min

Part 12 · Wrap-Up & Reference

The conclusion, a glossary of every short form, the full architecture in one picture, and a cheat sheet.

  1. Lesson 66System Design Series: The ConclusionSixty-five posts ago we started with a URL and the Enter key. The whole journey on one page, the twenty principles that matter most, a checklist you can use for any design, how every piece fits together, and what to do next.10 min
  2. Lesson 67System Design Glossary: Every Short Form ExplainedEvery short form in the series — TLS, CDN, ACID, CAP, SLO, JWT, K8s and 300 more — in plain English, with what it does and an everyday example.30 min
  3. Lesson 68The Complete System Design ArchitectureEvery building block from the series, assembled into one reference architecture — clients, edge, entry, services, cache, databases, object storage, search, async, analytics, external services and the cross-cutting layer — with four request flows traced through it and how it grows from one user to millions.20 min
  4. Lesson 69System Design in 15 Minutes: Recap & Cheat SheetThe whole series, compressed for the night before an interview: the framework, the numbers, the formulas, the nines, a one-screen recap of every part, “if you need X, use Y”, the big trade-offs, common problems and their fixes, and rapid-fire questions to test yourself.15 min

Glossary

312 short forms and terms — TLS, CDN, ACID, CAP, SLO, JWT, K8s and the rest. Inside any lesson, hover or tap a dotted term to see its meaning without leaving the page. Browse all terms →