System Design
Every term of the maze, defined simply and illustrated with an example. Click a term inside a definition to open it.
No term matches. Try another word.
The four guarantees of a transaction: Atomicity (all or nothing), Consistency (rules stay true), Isolation (transactions do not interfere), Durability (what is committed survives a crash).
Example · A transfer debits account A and credits account B, or does nothing at all.
Message a consumer sends to the queue to confirm it processed a message. Until it arrives, the queue may deliver the message again.
Example · The worker emails the invoice, then acknowledges the message, which leaves the queue.
Architecture where several regions serve traffic at the same time. No switchover needed on failure, but simultaneous writes to the same data must be reconciled.
Example · Customers in Abidjan are served by the West Africa region, those in Paris by the Europe region.
Architecture where one region serves all traffic while another waits, with replicated data, ready to take over through failover.
Example · The Paris region serves Mboa Market; the Johannesburg one only takes over during an outage.
One-page document that records an architecture decision: its context, the decision, its consequences and its status. It lives in the code repository and is never rewritten, only superseded.
Example · docs/adr/0012-shared-cache.md explains why the team chose Redis over local caches.
Networking technique where the same IP address is announced from several places in the world: each user is routed to the nearest one.
Example · Public DNS servers and most CDNs use anycast to answer from the closest site.
Application programming interface: the contract a program exposes so that other programs can use it (the possible calls, their parameters and their responses).
Example · Mboa Market's mobile app calls GET /products/42 on the API to display a product.
Single entry point in front of the services: it authenticates, applies rate limiting, routes each request to the right service and logs.
Example · Every partner request goes through the gateway, which checks their API key and quota.
Something taken as true in a design without having checked it yet. It is written down so that someone can confirm or correct it.
Example · “Assumption: the sales peak is three times a normal day's traffic.”
Describes work done later, without making the requester wait. It often goes through a message queue.
Example · The order is confirmed right away; the PDF invoice is generated asynchronously, a few seconds later.
The primary confirms a write without waiting for its replicas, which receive it just after. Fast, but with replication lag and a risk of loss if the primary fails.
Example · A replica in Johannesburg receives the Paris orders about two seconds behind.
Delivery guarantee: a message is never lost, but it may arrive more than once. Consumers must therefore be idempotent.
Example · A worker crashes before acknowledging: the “invoice 812” message is delivered a second time.
Proving who you are: password, code received by text, security key, fingerprint. Not to be confused with authorisation.
Example · You enter your number and the code received by text: Mboa Market knows it really is you.
Checking what the authenticated user is allowed to do, on every request and every object.
Example · You can see your invoices, but not other customers'.
Automatic adding and removing of servers based on load. It requires stateless servers that start quickly.
Example · Three servers at night, twelve on sale day, with no human intervention.
Share of time a service works, often expressed in “nines”: 99.9% means about 8.8 hours of downtime a year.
Example · A 99.99% target allows about 53 minutes of downtime a year.
Isolated datacenter (or group of datacenters) within a cloud region, with its own power and network. Two zones rarely fail at the same time.
Example · Mboa Market's servers are spread across three zones of the same region.
Quick estimate, with rounded numbers, to find the order of magnitude of traffic, storage or cost before designing.
Example · 500,000 users × 20 requests ÷ 100,000 seconds ≈ 100 requests per second.
Mechanism by which a saturated component tells its callers to slow down, instead of accepting work it will not be able to do.
Example · The queue is full: it refuses new messages with a 429, and the sender slows down.
Extent of the damage when something breaks: how many customers, services or countries are affected. You reduce it by isolating parts.
Example · With one database per country, an outage in Senegal does not affect customers in Cameroon.
The most limited component of a system: it sets the capacity of the whole. Improving another component is useless until it is relieved.
Example · The web servers run at 50%, the database at 120%: the database is the bottleneck.
Part of the business with its own vocabulary and data model (a Domain-Driven Design notion). It is a natural boundary for a module or a service.
Example · For the catalogue, a “product” has photos; for delivery, it has a weight and dimensions.
Program that displays websites (Chrome, Firefox, Safari…). It is a client: it sends requests and displays the responses.
Example · Your browser requests mboamarket.com and displays the page it receives.
Choice between developing a component yourself or using an existing product or service. You usually only build what differentiates the company.
Example · Mboa Market builds its recommendation engine, but buys text messaging from a provider.
Separating resources (threads, connections) per dependency, like a ship's watertight compartments, so that a single sick dependency cannot exhaust everything.
Example · The recommendation service has its own pool of 20 connections: even stuck, it leaves the others free.
Very fast memory that keeps copies of answers already computed, to serve them again without redoing the work.
Example · The best-selling fabric's page is served from Redis in one millisecond, instead of 20 ms from the database.
Changing a file's name with every version (often with a fingerprint of its content) so that caches and browsers download the new version.
Example · style.css becomes style.3f9a1c.css on every deployment.
The requested answer was already in the cache: it is served immediately.
Example · Out of 100 catalogue reads, 90 are cache hits.
Removing or updating a copy in the cache when the original data changes, so as not to serve stale data.
Example · The seller lowers their price: the application deletes the product:42 key from the cache.
The answer was not in the cache: it must be computed or read from the source, more slowly.
Example · First visitor on a rarely viewed product: cache miss, database read.
Way of using a cache: the application checks it first; on a miss, it reads the database then stores the answer in the cache with a TTL.
Example · Page missing from the cache → database read → copy into Redis for 5 minutes.
HTTP header that tells browsers and CDNs whether they may keep a copy of a response, and for how long.
Example · Cache-Control: max-age=31536000: this image may be kept for a year.
Shipping a new version to a small share of traffic first (5%, for example), monitoring, then widening. If something goes wrong, only a minority is affected.
Example · The new payment page is shown to 5% of customers for an hour before everyone.
During a network partition, a distributed system must choose between consistency (C, never answer wrong) and availability (A, always answer).
Example · Outage between two datacenters: payment refuses rather than risk a double charge (C), the cart stays open (A).
Number of distinct values a field takes. A good shard key has high cardinality.
Example · The customer id has millions of values; the order status, five.
Failure that spreads from one component to those that depend on it, often because they wear themselves out waiting for it.
Example · Recommendations slow down, the web servers block their threads, and payment goes down in turn.
Content delivery network: servers spread around the world that keep copies of static content as close as possible to users.
Example · Mboa Market's photos are served from Lagos and Johannesburg instead of Paris.
Reading a database's write log to publish every change as an event, without touching the application's code.
Example · Every change to the products table updates the search index a few seconds later.
Way of running a saga where each service reacts to the others' events, without a central conductor.
Example · Stock hears “order created” and reserves; payment hears “stock reserved” and charges.
Mechanism that stops calling a failing dependency: calls fail immediately (and a fallback answers), then a few trial calls check whether it is back.
Example · Recommendations answer in 4 s: the breaker opens and pages display without them.
Program that sends requests to a server: a browser, a mobile app, another service.
Example · The Mboa Market app on your phone is a client of the API.
Organisation where clients send requests and servers answer them. It is the foundation of the web.
Example · Your browser (client) asks for a page, Mboa Market's server (server) sends it back.
Operation that undoes the effect of an earlier step of a saga when a later step fails.
Example · The payment is declined: the compensation releases the reserved stock.
Number of requests being processed at the same moment. By Little's law, it equals throughput multiplied by latency.
Example · 500 requests per second lasting 0.4 s each: 200 requests in flight at once.
Technique that places keys and servers on a ring: adding or removing a server only moves a small share of the keys, instead of nearly all of them.
Example · Going from 4 to 5 shards only moves about 20% of the keys.
Limit imposed on the design, which you do not choose: budget, deadline, team size, existing technology, law.
Example · “Constraint: the solution must run on PostgreSQL, which the team already knows.”
Program that reads messages from a queue or a event log and does the corresponding work.
Example · The “invoices” worker consumes the queue's messages and generates the PDFs.
Set of consumers sharing the reading of a topic. Each group keeps its own offset: several teams read the same events independently.
Example · Delivery and accounting form two groups that both read every “order paid” event.
Observation that a system mirrors the communication structure of the teams that build it.
Example · Three autonomous teams almost always end up producing three services.
Separating the model that writes the data from the one (or ones) that serve complex reads, each optimised for its use.
Example · Orders are written to PostgreSQL; search reads a copy in a search engine.
Data structure that can be modified in several places at once and merged automatically, without conflict.
Example · A like counter incremented in two regions gives the right total after merging.
Pagination that asks for “the next N items after this one” using a cursor, instead of a page number. It stays fast even far down the list.
Example · GET /products?limit=20&cursor=eyJpZCI6NDJ9 returns the 20 products after no. 42.
Obligation, often legal, to store certain users' data in a given country or region.
Example · The regulator requires Cameroonian customers' payment data to stay in Cameroon.
Database dedicated to analysis, fed with copies of production data, so that heavy reports do not slow customers down.
Example · The year's sales by region are computed in the warehouse, not in the orders database.
Software that stores data durably and lets you find, change and protect it.
Example · Mboa Market's customers, orders and stock live in a PostgreSQL database.
Number of distinct users who use the service at least once in a day. The starting point of most estimates.
Example · 500,000 DAU × 20 requests each = 10 million requests a day.
Queue where messages that still fail after several attempts are put aside, to be analysed without blocking the others.
Example · An invoice with an invalid format fails three times and goes to the dead-letter queue; an alert notifies the team.
Stacking several independent layers of protection, so that one layer giving way does not open the whole system.
Example · Web application firewall, segmented network, multi-factor authentication, encryption and audit logs.
Document of one to three pages that presents a design before it is built: context, goals, non-goals, proposal, alternatives, risks, rollout plan.
Example · The new payment service's document is sent to the board 48 hours before the review.
Set of means and procedures to restart a service after a disaster (loss of a region, a datacenter, data), with a defined RTO and RPO.
Example · Twice a year, the team really switches Mboa Market over to the standby region.
Record of a request's path through every service, split into steps (“spans”) with their duration.
Example · A payment's trace shows 40 ms in the gateway, 30 ms in the service, 1.8 s in the fraud check.
Domain Name System: the Internet's phone book, which turns a domain name into an IP address.
Example · mboamarket.com → 203.0.113.10.
NoSQL database that stores documents (often JSON) whose fields can vary from one document to another.
Example · A fabric page has a size and a pattern, a phone page a capacity and a colour.
Readable name that designates a website or service on the Internet, turned into an IP address by the DNS.
Example · mboamarket.com, api.mboamarket.com.
Accounting principle: every movement is written twice, as a debit on one account and a credit on another, so that total debits always equal total credits.
Example · A 5,000 FCFA payment: debit on the customer's wallet, credit on the seller's account.
CDN server placed close to users, serving them copies of content without going back to the origin.
Example · A customer in Douala receives the photos from an edge server in Lagos.
Data leaving the cloud for the Internet. Providers charge it per gigabyte, and it is often a surprise line on the bill.
Example · 50 TB of images served directly from the servers: about $4,500 a month.
Encrypting data stored on disks, so that a stolen disk or backup stays unreadable.
Example · The database and its backups are encrypted with a key managed by the cloud provider.
What the SLO allows you to miss over the period (1 − SLO). While some is left, you can take risks; once spent, you harden.
Example · 99.9% over 30 days: a budget of 43 minutes of downtime.
Message that describes a past fact, in the past tense: it does not ask for anything, it announces.
Example · “Order 812 paid”, “Parcel 77 shipped”.
Ordered sequence of events that you only append to. Messages stay there for the retention period, even once read.
Example · The “clicks” log keeps seven days of events, which a new consumer can reread.
Storing the sequence of events as the source of truth, and rebuilding state by replaying them. Powerful for audits, demanding to implement.
Example · A wallet's balance = the sum of all its movements since it was opened.
Publishing events to a event log that several consumers read continuously, each at its own pace.
Example · Every click goes into Kafka; analytics and fraud detection read it within seconds.
Copies of a piece of data may diverge for a while, but end up converging if nobody changes it any more.
Example · A product's like count is a few seconds behind on some servers.
Effect achieved when each message produces its effect only once, even if delivered several times. In practice: at least once delivery + idempotent processing.
Example · The “charge 5,000 FCFA” message arrives twice, but the customer is only charged once.
Spacing retries further and further apart (1 s, 2 s, 4 s, 8 s…) to let a service recover instead of crushing it.
Example · Payment fails: retry after 1 s, then 2 s, then 4 s, then give up.
Search filters shown with the number of results for each value.
Example · “Size: M (124), L (98) · Price: under 10,000 FCFA (312)”.
Automatically replacing a failed component with its standby copy, for example promoting a replica to primary.
Example · The primary fails; within 30 seconds, the replica in the other zone becomes the new primary.
Backup answer served when a dependency does not respond: a default value, a simplified version, a clear message.
Example · Without recommendations, the page shows “best sellers” instead.
Switch that turns a feature on or off without redeploying, for everyone or for some users.
Example · The new checkout flow has a bug: its flag is turned off, the old one comes back in ten seconds.
Practice that makes cloud cost visible and manageable by teams: resource tagging, unit cost, regular reviews.
Example · Every month, the team reviews the five biggest lines of the bill and the cost per order.
Rate limiting algorithm that counts requests per fixed time slot (per minute, for example) and resets the counter at the start of each slot.
Example · 100 requests allowed between 10:00 and 10:01; the counter resets at 10:01.
The four measurements to watch for every service: latency, traffic, errors and saturation.
Example · The payment dashboard shows p95, requests per second, error rate and database load.
What the system must do: a feature, a behaviour visible to the user.
Example · “A customer can track their parcel.”
Search that finds the right results despite a typo or misspelling.
Example · “wax fabrik” still finds wax fabrics.
Exercise where the team deliberately causes a failure (a zone, a database, a dependency) to check that the system and the procedures hold.
Example · One Thursday morning, the team shuts down a whole zone and times the return to normal.
DNS that returns a different address depending on the user's location, to send them to the nearest region or to a standby region.
Example · mboamarket.com points to Johannesburg for Africa and to Paris for Europe.
Keeping the essential service running when a part fails, temporarily giving up secondary features.
Example · Search is down: the home page shows categories, and payment still works.
Choosing a piece of data's shard by computing a fingerprint of its key (hash(key) % N): data spreads evenly.
Example · Customer 4821 lands on shard hash(4821) % 4 = 1.
Regular check that a server answers correctly; a failing server is taken out of rotation by the load balancer.
Example · Every 5 seconds, the load balancer calls GET /health on every server.
Share of reads served directly by the cache. The higher it is, the less the database works.
Example · A 90% ratio: the database only sees one read in ten.
Region a customer is attached to: all their writes go there, which avoids conflicts in active-active.
Example · Ivorian accounts always write in Abidjan, even when the customer travels to Paris.
Growing a system by adding identical machines behind a load balancer, rather than enlarging one machine.
Example · Going from 3 to 12 web servers for sale day.
Key that receives a disproportionate share of traffic: it overloads the shard or cache node holding it, however many there are.
Example · A star's shop concentrates 70% of writes on a single shard.
The web's protocol: the format of the requests (verb, address, headers) and responses (status code, content) exchanged between clients and servers.
Example · GET /products/42 → 200 OK and the product page.
HTTP encrypted with TLS: nobody along the way can read or change the exchange.
Example · The padlock in the address bar indicates an HTTPS connection.
Property of an operation that can be run several times with the same effect as once.
Example · “Mark order 812 as paid” is idempotent; “add 5,000 FCFA to the balance” is not.
Unique identifier sent with an operation: if the server sees it again, it returns the first result instead of starting over.
Example · The Idempotency-Key: 7f3a… header prevents a double charge when the app resends a payment.
Access control flaw: the server returns an object designated by its id without checking that it belongs to the user.
Example · Changing /invoices/1043 to /invoices/1044 shows another customer's invoice.
Person who coordinates the response to an incident: they assign roles, make decisions and keep information flowing, without doing everything themselves.
Example · “I am taking command. Aïcha communicates, Koffi switches over. Check-in in 15 minutes.”
Structure that lets a database find rows without reading the whole table, like a book's index. It speeds up reads and slightly slows down writes.
Example · An index on customer_id finds a customer's 20 orders among 10 million in a few milliseconds.
Search engine structure that maps each word to the list of documents that contain it.
Example · “wax” → products 12, 48, 301; “fabric” → products 12, 77, 301.
Number that identifies a machine on a network, like a postal address.
Example · 203.0.113.10 (IPv4) or 2001:db8::10 (IPv6).
Small amount of randomness added to a wait, so that thousands of clients do not all retry in the same second.
Example · Instead of retrying after exactly 2 s, each client waits between 1.5 and 2.5 s.
JSON Web Token: signed token carrying a user's identity and rights. The server verifies it without storing anything, but it is hard to revoke before it expires.
Example · A token valid for 15 minutes, renewed while the session is active.
Open-source event streaming platform: a distributed event log, split into topics and partitions, read in parallel by many consumers.
Example · The “orders” topic receives every Mboa Market order event.
Store that maps a value to a key, and finds it extremely fast by that key.
Example · session:8c1f → the signed-in customer's identity and cart.
Conflict resolution rule: when two copies were modified, the most recent change is kept. Simple, but the other change is lost.
Example · Two devices change the address at the same time: the one saved last is kept.
Time a request takes to get its response, in milliseconds.
Example · The product page displays in 180 ms.
Load balancer algorithm that sends each request to the server handling the fewest at that moment.
Example · A server busy with three PDF exports receives no more requests while the others are free.
Giving each person, service or key only the rights strictly necessary for its task.
Example · The email service can read addresses, but not payment data.
Record of every money movement, append-only: a line is never modified, a correcting entry is added.
Example · A Mboa Pay wallet's balance is computed from its ledger.
Relationship between throughput and latency: requests in flight = throughput × time spent in the system.
Example · 100 req/s × 0.2 s = 20 requests at once; if latency goes up to 2 s, 200 are needed.
Component that receives every request and spreads them across several servers, leaving out those that stop answering.
Example · The load balancer sends Mboa Market's visitors to four web servers.
Deliberately refusing the least important traffic when the system overflows, to protect what matters most.
Example · At peak, recommendations and bots are cut to keep payment fast.
Deliberately sending heavy, realistic traffic to the system to measure what it can handle before real customers arrive.
Example · A week before the sales, the team simulates 5,000 req/s for an hour.
Lines of text an application writes to describe what it does, useful to understand an incident.
Example · 2026-11-06 14:12:03 payment 8812 declined: insufficient balance.
Small packet of data put into a queue or a event log to be processed by another program.
Example · {"type": "invoice", "order": 812}.
Component that receives messages from producers and hands them to consumers, to do work later and absorb spikes.
Example · RabbitMQ, Amazon SQS or Google Pub/Sub carry Mboa Market's invoice requests.
Numerical measurements tracked over time: requests per second, latency, error rate, load.
Example · A curve of the payment p95, minute by minute.
Small independent service, with its own database, deployed and sized separately, communicating with others over the network.
Example · The payment service is deployed separately, by its team, several times a week.
A single application deployed as one block, but split into modules with strict boundaries, which do not share their tables.
Example · Catalogue, orders and delivery are three modules of the same Django application.
Single application that contains every feature and deploys as one block.
Example · The whole Mboa Market shop fits in one application, one database, one deployment.
Mean Time Between Failures: average time between two failures.
Example · One failure every 60 days on average: an MTBF of 60 days.
Mutual TLS: client and server each present a certificate, so both sides know who they are talking to.
Example · The orders service can only call the payment service with its own certificate.
Mean Time To Repair (or To Recover): average time to restore service after a failure.
Example · With automatic rollback, the MTTR goes from 40 to 5 minutes.
Authentication that requires at least two proofs of different kinds: something you know, something you have, something you are.
Example · A password, then a code received by text or generated by an app.
Outage that splits a distributed system into pieces that can no longer communicate, even though each one works.
Example · The link between the Douala and Abidjan datacenters is cut for 20 minutes.
What says how well the system must do its job: latency, availability, volume, security, cost, compliance.
Example · “99% of payments in under 2 seconds.”
Family of databases that do not use the classic relational model: key-value store, documents, columns, graphs. They trade some guarantees for other qualities.
Example · Redis (key-value), MongoDB (documents), Cassandra (columns), Neo4j (graphs).
Protocol that lets an application act on behalf of a user, with a limited token, without ever knowing their password.
Example · A partner carrier accesses the orders of a seller who authorised it, and nothing else.
Service that stores files (images, videos, backups) reachable through a URL, with almost no size limit.
Example · Sellers' photos are stored in an S3 bucket, not on the web servers.
Ability to understand what happens inside a system from what it emits: metrics, logs and distributed traces.
Example · Within two minutes, the team sees that payment is slow because of one specific SQL query.
Number of the last message read by a consumer group in a partition of a event log.
Example · Rewinding to yesterday morning's offset replays a day of events.
Arrangement where engineers, in turn, can be reached to respond to alerts outside office hours.
Example · This week, Koffi is on call: the payment alert wakes him up if needed.
Standard format for describing a REST API (routes, parameters, responses), from which documentation, clients and tests are generated.
Example · Mboa Market's openapi.yaml file is reviewed by the mobile team before any development.
Identity layer on top of OAuth 2.0: it lets you sign in to an application with an existing account.
Example · Mboa Market's “Sign in with Google” button.
Way of running a saga where a conductor service calls each step in order and triggers the compensations.
Example · The “order” service asks stock to reserve, then payment to charge.
The servers where the reference content comes from, which the CDN copies and caches.
Example · The CDN asks the origin for an image again when its copy has expired.
Writing the event to publish into an outbox table, in the same transaction as the data, then publishing it through a relay. Data and event exist together, or not at all.
Example · The order and the “order created” event are saved in the same transaction.
Foundation that publishes, among other things, the ranking of the most common web security flaws (the OWASP Top 10).
Example · Broken access control tops the OWASP ranking.
Latency below which 50% of requests fall: what the typical customer experiences.
Example · p50 = 80 ms: one request in two answers in under 80 ms.
Latency below which 95% of requests fall. The remaining 5% are slower.
Example · p95 = 300 ms: 19 requests out of 20 answer in under 300 ms.
Latency below which 99% of requests fall: what the unluckiest customers experience.
Example · p99 = 2 s: one customer in a hundred waits at least 2 seconds.
Extension of the CAP theorem: under a Partition, choose between Availability and Consistency; Else, choose between Latency and Consistency.
Example · Even without failures, reading a nearby replica is faster, but may return a slightly old value.
Returning a long list in pieces (pages) instead of a single block.
Example · GET /products?limit=20 returns 20 products and what is needed to ask for the next ones.
Security standard imposed by card networks on any organisation that stores, processes or transmits card data.
Example · By storing only the provider's token, Mboa Market sharply reduces its PCI DSS scope.
Ratio between traffic at the busiest moment and average traffic. Often 2 to 3, far more on a sale day.
Example · 100 req/s on average, 300 req/s at 8 pm: a peak factor of 3.
Value below which a given percentage of measurements falls. For latency, you track the p50 (median), p95 and p99.
Example · The 95th percentile of response times is 300 ms.
Site of a CDN (or a network) set up in a city to be close to users.
Example · The CDN has points of presence in Lagos, Nairobi and Johannesburg.
Written analysis after an incident: what happened, why, and what changes. It is “blameless”: it looks for causes, not culprits.
Example · “Cause: a 24 h DNS TTL delayed the switchover. Action: bring it down to 60 s.”
Exercise before a project: imagine it failed six months from now and list why, to deal with the risks in advance.
Example · “Payment failed because the single provider went down on sale day.”
In a replicated database, the copy that receives every write and passes it on to the replicas.
Example · Orders are written to the Paris primary, then copied to two replicas.
Program that puts messages into a queue or a log.
Example · The orders service produces an “invoice” message for every paid order.
Removing a copy from a CDN before its TTL ends, to force a return to the origin.
Example · An image published by mistake is purged from the CDN within seconds.
Minimum number of copies that must confirm a write (W) or answer a read (R). If R + W > N copies, a read always sees the latest write.
Example · N = 3, W = 2, R = 2: you survive one lost copy without reading an old value.
Splitting data by key ranges (dates, letters…). Handy to read a period, but recent data piles up on one shard.
Example · One shard per month: every November order lands on the same one.
Limiting the number of requests a client can make per period; beyond it, the server answers 429 Too Many Requests.
Example · 20 requests per second per client, 1,000 for an identified partner.
Replica used to serve reads and relieve the primary.
Example · Catalogue searches read the replicas; payments read the primary.
Guarantee that a user always sees their own changes, even if other reads go through lagging replicas.
Example · For 5 seconds after changing their address, the customer reads their profile from the primary.
Comparing your own records with a partner's (bank, operator) to detect and fix differences.
Example · Every hour, Mboa Pay's ledger is compared with the Mobile Money operator's statements.
In-memory key-value store database, widely used as a cache, session store and counter.
Example · Mboa Market's carts and sessions live in Redis.
Having several copies of a critical component so that a single failure does not stop the service.
Example · Three web servers, two load balancers, a database and its replica.
Geographic area of a cloud provider, made of several availability zones.
Example · The “Europe (Paris)” and “Africa (Cape Town)” regions.
Database that stores data in linked tables, described by a schema, and queried in SQL.
Example · PostgreSQL, MySQL, SQL Server.
Score a search engine gives each result to decide their order.
Example · A product with “wax” in its title comes before one that mentions it in its description.
Copy of a database, kept up to date from the primary.
Example · A replica in another zone can become primary if the first one fails.
Continuously copying a database's data onto other machines, to read more and survive a failure.
Example · Every order written in Paris is copied to two replicas within a second.
Delay between a write on the primary and its arrival on a replica.
Example · A 2-second lag: a replica may show the old address for 2 seconds.
Demand sent by a client to a server: read a page, create an order…
Example · GET /products/42.
Number of requests a system receives or handles every second: the unit of throughput.
Example · Mboa Market's server handles 300 req/s.
Machines rented for one or three years in exchange for a large discount, ideal for what runs all the time.
Example · The production database, running day and night, costs 40% less as a reserved instance.
What the server sends back to the client: a status code and, often, a body.
Example · 200 OK with the product page as JSON.
API style where you handle resources named by URLs with HTTP verbs: GET, POST, PUT, PATCH, DELETE.
Example · POST /orders creates an order, GET /orders/7 reads it.
Resending a request that failed, hoping for a passing error. Reserved for idempotent operations, with exponential backoff.
Example · The provider answers 503: another attempt a second later.
When every client retries at once, they multiply the load on an already fragile service and keep it from recovering.
Example · 200 clients retry three times each as soon as the service is back: it receives four times its traffic and falls over again.
Matching machine sizes to their real load, so as not to pay for unused capacity.
Example · Twelve servers at 17% load brought down to four servers at 50%.
Updating servers one at a time: the load balancer takes out the one being updated, then puts it back in service.
Example · Out of four servers, three serve customers while the fourth moves to the new version.
Load balancer algorithm that sends requests to each server in turn.
Example · Request 1 → server A, request 2 → B, request 3 → C, request 4 → A…
Recovery Point Objective: how much data you accept to lose in a disaster, expressed as time worth of writes.
Example · 5-second RPO: at worst, the last 5 seconds of orders must be reconstructed.
Recovery Time Objective: maximum accepted downtime before the service is restored.
Example · 15-minute RTO: the standby region must serve customers 15 minutes after the outage.
Written step-by-step procedure for an operation or an incident: what to check, what to do, at which thresholds.
Example · “If the database exceeds 90%: turn off recommendations, then notify on-call.”
Operation split into local transactions, one per service, chained by events; if a step fails, compensating transactions undo the previous ones.
Example · Order → stock reservation → payment → shipping, with a compensation for each step.
State of a component that has reached the end of its capacity: requests wait, then are refused.
Example · At 600 req/s for a capacity of 300, the server saturates and refuses half the requests.
Description of the data's structure: the tables, their columns, their types and their links.
Example · The orders table has the columns id, customer_id, amount and status.
Service that keeps the versions of each event type's format and rejects changes that would break consumers.
Example · Removing the amount field from “order paid” is rejected: three teams read it.
Program that crawls a website automatically to copy its content, often at high speed.
Example · A competitor copies every Mboa Market price each night, 1,600 pages per second.
Software specialised in full-text search: it builds an inverted index, ranks results by relevance and tolerates typos.
Example · Elasticsearch, OpenSearch, Meilisearch, Typesense.
Service that stores passwords, API keys and certificates encrypted, hands them to authorised services and rotates them.
Example · The payment service receives its API key at start-up; it changes automatically every 90 days.
Machine or program that waits for requests and sends back responses.
Example · Mboa Market's web server sends back the catalogue pages.
What lets the server recognise a signed-in customer from one request to the next: their identity, their cart, their preferences.
Example · A cookie holds the session id; the session's data lives in Redis.
One of the databases the data is split across in sharding; each one owns part of the data.
Example · Shard 2 holds the customers whose id falls into its share of the ring.
Field that decides which shard each piece of data goes to.
Example · The customer id: all of a customer's orders are on the same shard.
Splitting data across several databases to spread writes and volume beyond what a single machine can carry.
Example · Four databases, each with a quarter of Mboa Market's customers.
Component present as a single copy whose failure stops the whole service.
Example · A single database, with no replica: if it fails, all of Mboa Market fails.
Service Level Agreement: contractual service-level commitment to a customer, with penalties if it is not met.
Example · 99.9% monthly availability for partners, otherwise a 10% discount on the bill.
Service Level Indicator: the measurement of service quality, as the customer sees it.
Example · The share of payments that succeed in under 500 ms.
Rate limiting algorithm that counts requests over the last N seconds at every moment, without the jolts of the fixed window.
Example · At 10:00:30, you count the requests received since 9:59:30.
Service Level Objective: the target set on an SLI, over a given period.
Example · 99.9% of payments succeeding in under 500 ms, over a rolling 28 days.
The store that is the reference for a piece of data; the others are copies that can be rebuilt.
Example · The products database is the source of truth; the search index is rebuilt from it.
The cloud provider's unused machines, rented at a large discount but which can be taken back at any time. Ideal for interruptible jobs.
Example · The nightly recommendation recomputation runs on spot instances.
Standard language to query and change a relational database.
Example · SELECT * FROM orders WHERE customer_id = 42;
Copy of a piece of data that is no longer up to date, for example in a cache or a lagging replica.
Example · The cache still shows the old price, although the seller lowered it.
Describes a server that keeps information in memory between two requests (sessions, carts): it is not interchangeable.
Example · A server that keeps the cart in memory: if it restarts, the carts disappear.
Describes a server that keeps nothing between two requests: any server can answer any request, and servers can be added or removed at will.
Example · Sessions are in Redis: restarting a web server logs nobody out.
Files that are the same for every visitor and rarely change: images, CSS, JavaScript, videos.
Example · A fabric's photo is the same for every customer; their cart is not.
Three-digit number at the start of an HTTP response: 2xx success, 3xx redirect, 4xx request error, 5xx server error.
Example · 200 (OK), 302 (redirect), 404 (not found), 429 (too many requests), 500 (server error).
Load balancer setting that always sends the same client to the same server, because that server holds their session.
Example · The whole campus comes through one IP address and lands on the same server.
Storage levels with different prices and speeds: hot (read often, more expensive), cold or archive (rarely read, far cheaper).
Example · Logs older than 30 days move automatically to cold storage.
Gradual migration: a gateway in front of the old system routes each feature to the new one, bit by bit, until the old one can disappear. The name comes from a fig tree that grows around a host tree.
Example · First 5% of photo uploads to the new service, then 50%, then 100%.
Every read sees the latest committed write, as if only one copy of the data existed.
Example · Right after a payment, every balance read shows the new amount.
The primary waits for at least one replica to receive the write before confirming it: no loss if the primary fails, but every write is slower.
Example · Mboa Pay's ledger waits for its replica in the other zone before confirming a payment.
Exercise that lists, for a feature, who could attack it, to steal or break what, through where, and how to protect against it.
Example · Before card payments: card theft, insider fraud, denial of service, injection.
Amount of work handled per unit of time, often in requests per second.
Example · The payment service handles 120 payments per second.
Sudden rush of requests to a resource at the same moment, for example when an empty cache sends every read to the database.
Example · The cache restarts: 2,000 reads per second hit the database all at once.
Maximum time you wait for an answer before giving up, to free resources.
Example · After 300 ms without an answer from recommendations, the page displays without them.
Protocol that encrypts and authenticates a network connection. It is what puts the “S” in HTTPS.
Example · mboamarket.com's TLS certificate proves to the browser that it is talking to the right server.
Rate limiting algorithm: a bucket of N tokens refills at a fixed rate; each request uses a token; empty bucket, request refused. It allows small bursts.
Example · 10 tokens, refilled at 2 per second: a burst of 10 goes through, then 2 requests per second.
Replacing a sensitive piece of data (a card number) with a worthless token, the real data staying with a specialised provider.
Example · Mboa Market only keeps tok_8f3a…; the card number stays with the payment provider.
Named stream of events of the same type in a event log such as Kafka, split into partitions.
Example · The “orders-paid” topic has 24 partitions.
Full cost of a solution over its lifetime: purchase or development, but also operations, maintenance, security and team time.
Example · A “free” home-made system that keeps two engineers busy full time costs more than a $500-a-month service.
Group of database operations that all succeed together or all fail together.
Example · Create the order, remove the item from stock and record the payment, in a single transaction.
Time To Live: lifetime of a cached copy; after that delay, it is dropped and reloaded on the next read.
Example · Product pages have a 5-minute TTL in Redis.
Twelve-principle method for building cloud-ready applications: stateless processes, configuration in the environment, logs on standard output, fast start-up and shutdown…
Example · The database key is read from an environment variable, never written in the code.
Distributed transaction protocol: a coordinator asks each participant whether it is ready, then tells them to commit. Reliable but blocking if the coordinator fails at the wrong moment.
Example · Four databases wait for the decision of a coordinator that just crashed.
Infrastructure cost per business unit: per order, per active customer, per transaction.
Example · $12,000 for 400,000 orders: 3 cents per order.
Share of a component's capacity that is in use. Beyond 70 to 80%, waiting grows very fast.
Example · 280 req/s on a server that handles 300: 93% utilization, and latency taking off.
Situation where leaving a provider becomes very costly, because the system relies on its proprietary services.
Example · An application written around one cloud's proprietary database.
Growing a system by replacing a machine with a more powerful one. Simple, but with a ceiling, and the machine remains single.
Example · Going from an 8-core server to a 64-core server.
Filter placed in front of web applications that blocks known attacks and malicious bots before they reach the servers.
Example · The WAF blocks SQL injection attempts and bursts of sign-ins from a botnet.
HTTP call one system sends automatically to another when an event happens.
Example · The payment provider calls POST /webhooks/payment when a payment is confirmed.
Program running in the background that processes tasks, often taken from a message queue.
Example · Three workers generate the PDF invoices from the “invoices” queue.
Security principle: never trust a request because it comes from “inside” the network; every call is authenticated and authorised.
Example · Even between two internal services, every call presents a certificate and goes through an authorisation check.
Runbookly assistant
Quick answers about the site. A person answers through the contact page.