GitHubPostmortem
October 2021 post-incident analysis
A real network partition: automated failover promoted a cross-country database primary, both sides accepted writes the other never saw, and failing back stopped being safe.
Case Studies
System blueprints
The same trade-offs the concepts cover, met by real teams at real scale. Postmortems where it went wrong, write-ups where it went right. Filter by theme, and follow the concept link to the page behind it.
21 case studies
AmazonPaper
Amazon's Dynamo
The paper that made availability the default: eventual consistency, vector clocks, and a shopping cart that must stay writable while the network is broken.
Figma
How multiplayer technology works
Concurrent edits from many clients converging on one document, and why they chose their own approach over off-the-shelf conflict resolution.
Airbnb
Avoiding double payments in a distributed payments system
What it takes to retry a payment safely when the first attempt might have succeeded and you cannot tell.
FacebookPaper
Scaling Memcache at Facebook
The canonical caching-at-scale paper: leases against stampedes, regional pools, and what happens when a cold cluster takes live traffic.
Notion
Sharding Postgres
Choosing a shard key for real data, and the migration it took to get there without downtime.
OpenAI
Scaling PostgreSQL
How far a single primary plus read replicas goes before sharding becomes unavoidable.
Discord
How Discord stores trillions of messages
Hot partitions, the limits they hit on Cassandra, and what moving the whole message store bought them.
Twitter
Announcing Snowflake
Unique IDs without a central counter, the problem you inherit the moment auto-increment stops working across shards.
Uber
H3, a hexagonal hierarchical spatial index
Partitioning space instead of rows, so proximity queries stay cheap as the map fills up.
Netflix
DBLog, a generic change data capture framework
Keeping search indexes, caches, and derived stores in step with the database that owns the truth.
Etsy
Turbocharging Solr index replication with BitTorrent
Copying a 28 GB search index from one primary to every replica made replication time grow linearly with the fleet and pinned the primary's network card. Letting the replicas seed each other over BitTorrent decoupled the two.
GitHub
GLB Director, an open source load balancer
A layer 4 load balancer designed in the open, including how connections survive a backend coming and going.
Netflix
Fault tolerance in a high volume distributed system
Circuit breakers, bulkheads, and fallbacks: how one failing dependency is stopped from taking the product with it.
CloudflarePostmortem
The 18 November 2025 outage
A permissions change doubled the size of an internally generated config file, it blew past a fixed preallocation, and the proxy panicked. Internal input is still input.
GoCardlessPostmortem
Incident review: API and dashboard outage on 10 October 2017
A primary database node failed and the cluster manager declined to promote any replica, because one Pacemaker colocation rule ranked every candidate at negative infinity. A failover budgeted at two minutes ran for nearly two hours.
AWSPostmortem
Summary of the EC2 and RDS service disruption in US East
A network change routed EBS traffic onto a secondary network that could not carry it. When connectivity returned, the isolated nodes all tried to re-mirror at once, and the storm filled one zone and then the region's control plane.
Stripe
Designing robust and predictable APIs with idempotency
Idempotency keys, and why any API a client will retry needs them before it needs anything else.
Stripe
Scaling your API with rate limiters
Four different limiters, each protecting against a different way callers overwhelm you.
Slack
Real-time messaging
Holding millions of long-lived connections open, and what has to give when every client expects instant delivery.
Zerodha
Scaling with common sense
Millions of trades a day on Postgres, Redis, and Go, as the counterweight to every design that assumes scale demands exotic infrastructure.