How real companies scaled.
94 engineering write-ups from 28 companies, searchable by stack, scale and technique.
The best scaling write-ups, weekly
How Figma manages sandboxes at scale
Figma's AI products needed secure places to run untrusted code, so the team built Nimbus, a centralized sandbox platform that product teams call through a simple namespace config and GetOrCreate/Get/Delete APIs. Nimbus picks a cloud provider, applies networking and security policies (trusted-host allowlists plus read-only GET/HEAD/OPTIONS to the rest of the internet, credentials decrypted only on the way out to their intended destination), and runs sandboxd inside each box for process supervision and metrics. Warm pools of already-running sandboxes cut provisioning latency by about 90% versus cold starts, raised availability from 99% to 99.95%, and absorb minutes of provider outages while Postgres claim transactions and a Redis health-check queue keep the pool correctly sized and singly assigned.
Scaling Model Evaluation at Pinterest with Ray (Part 4)
Pinterest's feature-importance and multi-experiment evaluation used to run Ray inference, write predictions to S3, then start a separate metrics job that reread everything. They defined a ReducibleMetric contract (dataset_preprocessor, compute_partials, reduce_partials) so MAE, threshold-based ROC-AUC, and group-wise Precision@K can all compute from batches or segment-preserving buckets, then fused metric reduction into the Ray inference pass via the shared object store. On a Pin Ranking Model, fusion cut end-to-end wall-clock time by up to 32% (25–32% at 100 experiments across ≈30K–3M row sets) and kept Large-set runtime roughly linear (~43 min fixed plus ~41s per experiment up to 300), absorbing a separate ~11s-per-experiment metrics stage.
F3 Lightning: How Meta Accelerates Ads ML Features to Production at Scale
Meta's Facebook Feature Framework (F3) compiles ads ranking features into one merged DAG so shared work runs once, but that graph was also the release unit, so one bad definition blocked every other feature as the catalog grew past 20,000 features per request. F3 Lightning makes each feature an independently compiled, validated, deployed, and rolled-back configuration, then rebuilds shared execution at service startup: stable identifiers derived from each computation's meaning, one flattened execution plan that deduplicates common nodes, a single per-request memory buffer, and dense integer slot mapping so request-path reads are direct array indexes. Comparable extraction features now reach production about 3.6x faster than traditional F3 with no increase in infrastructure compute cost.
Scaling Git at OpenAI
OpenAI built Pando, a Git-compatible backend for its monorepo after Codex pushed concurrent branches, merges and fetches past the old system (reliability sometimes below 90%). Pando stores each push as an immutable pack in blob storage and records per-branch ref versions in a horizontally scalable metadata store, giving serializability per ref and causal consistency across the repo so unrelated branches do not contend. Instead of building unique packs per client, it reuses stored packs and serves them via packfile-uri through regional Express caches (over 99% hit rate), with LSM-style background compaction so fetches plan in logarithmic time. Deployed first as a read/write-through proxy, then cut over with a Git CLI wrapper; it now powers all monorepo development, cut median push latency by nearly 5x, and can deliver nearly a petabyte of Git data per day (57+ TB in a single hour).
Catching Bugs Before They Land: JiTTesting's Human-on-the-Loop Approach at Full Scale
Meta's Catching Just-in-Time Tests (JiTTests) are now production infrastructure. Overnight, on spare capacity, the system picks risky diffs from the previous day and generates tests designed to fail: a "dodgy diff" workflow treats each change as a mutant, while an intent-aware workflow infers what the diff is meant to do, lists the risks, and builds mutants from them. An ensemble of LLM judges plus a deterministic rule-based assessor (RubFake) ranks the failing "weak catches", and engineers are only contacted for the strongest ones. 589 engineers have engaged, reporting 60% true positives, and in the first half of 2026 it helped catch 74 serious privacy bugs before landing, cutting privacy SEVs by 20%.
Designing a planned switchover for minimum disruption
When a Neki shard's primary has to step aside for a pod replacement, kernel upgrade or cell move, PlanetScale does a planned switchover instead of stopping Postgres the way Patroni does, so a failed switchover can quickly fall back to the old primary. Admin, Neki's control plane, first validates shard state, the target replica, logical failover slots and Postgres settings. Routers then proactively buffer primary-bound queries, the primary defaults new transactions to read-only, and the other replicas are disconnected to pin a final WAL position the target must replay. If the target can't catch up before a deadline, a config reload makes the old primary writable again. Buffered queries are replanned against the new primary, so apps see added latency instead of errors, and every acknowledged commit is on the target when it is promoted.
Rapidly scaling online storage to serve over 1 billion ChatGPT users (Part II)
OpenAI's Habitat storage platform went from one shared Azure Cosmos DB container, to dedicated single-tenant containers that pushed capacity planning onto every product team, and back to a shared container by default once Azure added hot-key throttling, request-priority QoS and a new serverless mode where each physical partition scales to 10K RU/s and splits on RU usage. After failover and failback outages in late 2024, OpenAI and Azure now co-own testing and monitoring. Replicating small latency-critical datasets widely, a Valkey lookaside cache invalidated through the Cosmos DB change feed, and a Rust rewrite of the proxy cut global read p50 from about 120 ms to about 10 ms.
Origin Range Requests: Serving large files without range-request tuning
Cloudflare's old range-request caching sliced files into a per-zone configured range size, so a small video seek could pull 128 MiB from origin for R2, while small ranges caused floods of tiny origin requests and memory pressure, and concurrent requests in the same range blocked each other. Moving from nginx to its Pingora-based cache, it reused Pingora's fixed-size on-disk chunks as the unit: a coordinator serves cached bytes, attaches to in-flight downloads, fetches only missing chunk-aligned ranges from origin, and validates size and ETag before composing one 206 response. For R2, p99 time to first byte dropped by about half, and letting one response combine disk and upstream bytes cut tiered cache traffic about 6% week over week.
Shard design doesn't start from your tables
In Neki, PlanetScale's sharded Postgres, a shard group is the unit of co-location: tables in the same group that hash their shard key the same way (xxhash into a 64-bit keyspace split by key ranges) always land on the same shard. Sharding customers, orders, items and addresses by customer_id keeps single-customer queries and transactions on one shard, which matters because a transaction across two shards gets no atomic commit or shared snapshot. Lookup tables become reference tables copied to every shard, catalog tables get their own group keyed on lower(sku), range and modulo indexes support legacy schemes, and a global secondary index routes queries like orders by id without fanning out. Shard groups can be changed later with the Reshard workflow.
Single-tenant Titus: VM-level isolation on a multi-tenant container platform
Titus, Netflix's Kubernetes-based container platform, launches millions of containers a week on tens of thousands of EC2 instances, packing many teams onto shared hosts. cgroups can't fence last-level cache, memory bandwidth or the global lock in HTB network shaping, so a small-packet flood from one container could starve its neighbors, and stateful streaming jobs like Flink would fall behind and need minutes to catch up. After ruling out microVMs (Firecracker, Kata), gVisor and moving teams to plain EC2, Netflix added an allowlisted single-tenant mode: the federation layer tags eligible tasks, the autoscaler launches the smallest instance that fits each one just in time, and anti-affinity, taints, no preemption and no repacking keep it alone on its host, all behind the same Titus API. Flink, streaming connectors and telemetry pipelines now report stable operation, and the shared fleet packs more densely because sensitive workloads no longer need anti-affinity spreading. The cost is slower launches, since every task waits for its own instance, and fixed host overhead that can take tens of percent of a small node.
App stability at scale with a layered defense
With many engineers and AI-assisted code landing in a weekly release of a superapp that has millions of lines of Android code, Grab stops crashes in layers. Lint rules (including custom ones written after post-mortems) and tests block merges, a mandatory one-week Grab Early Access build catches crashes before production, and a staged rollout over a week is automatically paused when the new version's crash rate looks abnormal. In production, on-call engineers first flip feature flags, then try server-side fixes, then hotfix, helped by a flag-rollout history dashboard and Crashlytics data exported to BigQuery.
The bridge to agent-scale Git infrastructure
GitHub has copied 99.99999% of its Git repositories to Azure, where most now keep two of their five replicas and Azure serves about half of Git traffic. The busiest remaining repositories were blocked by a ~25ms cross-region round trip, because Spokes held a repository-wide lock for each write while waiting on the slowest healthy replica. Scoping the quorum to individual Git references lets writes to different branches proceed in parallel (3-4x higher throughput in internal testing), and a virtual write replica that streams writes into Azure Blob Storage lets stateless read replicas scale out on demand.
Cross-store product clustering across millions of stores
Shopify groups the same real-world product sold by different merchants under one Universal Product Identifier. Embedding nearest-neighbor search finds plausible pairs across billions of listings, then three scorers of rising cost judge them: a CPU GBDT (L1) over trillions of pairs, a fine-tuned multilingual E5 cross-encoder (L2), and an image-aware reranker (L3) fed from prioritized GPU queues. A bounded union-find splits the graph into single-machine components, and HAC with a learned GBDT merge rule builds high-precision clusters daily, with an LLM judge validated against human labels supplying training data and cached scores reused between builds.
Inside Prometheus: Meta's Journey to a Gigawatt-Scale Supercluster
Meta turned its New Albany, Ohio data center site from web traffic into Prometheus, a gigawatt-scale AI supercluster spanning multiple interconnected buildings that behaves as one machine. It runs NVL72 racks (Catalina on GB200 with 800G of scale-out per GPU, Clemente on GB300 in a single rack) on a dedicated Ethernet back-end network for GPU-to-GPU traffic. Reliability work pushed pre-training goodput above 85% and mean time between interruptions past 54K GPU hours, and the cluster is growing toward roughly 1 million GPUs.
Ontology-Driven Observability: Building an End-to-End Knowledge Graph at Netflix Scale
Netflix found a typical regression investigation took about four hours, mostly spent reconstructing relationships between systems like Atlas, Radar, Spinnaker, PagerDuty, incident.io and Slack that each named the same thing differently. It built an Observability Ontology on the W3C stack (RDF, OWL, SHACL, SPARQL), stored as a knowledge graph in QuipuDB, its homegrown distributed quad store built on the Rust key-value store redb. Enrichers, some LLM-based, turn noisy inputs into typed triples, every application is validated against a catalog of about 49,000 entries, and dependency edges are capped. A correlation engine scores chains across 13 signal types within a ten-minute window, discarding anything under 0.6 confidence, and an agentic AutoRCA system reads the graph to hand engineers ranked, evidence-backed hypotheses.
2026 World Cup: Breaking Records, Spiky Charts and Reliability at Scale
How Meta absorbed the 2026 World Cup, when WhatsApp set a record of more than 30 million messages per second during the final. Pre-provisioned capacity buffers were the most effective lever, alongside country-level shedding of non-critical load, load-testing and resizing 100+ services, forecasting each region's peak separately, and no deploy freeze.
TimeSeries Tiered Storage Journey: Kafka/Flink Streams to Native Cassandra Cold Reads
Netflix moved older data in its multi-petabyte TimeSeries Abstraction out of hot Cassandra storage in two steps. First, Kafka and Flink streamed events to S3 as Parquet files, which a daily job compacted into small, time-sorted row groups with Bloom filters cached in EVCache (p50 ~150 ms, p99 ~500 ms). The second design skips that streaming pipeline: a ReadOnlyCompactionStrategy aligns immutable SSTables to token ranges, and a custom pluggable Memtable (Cassandra 4.1) reads directly from existing Cassandra backups in S3. It now holds over 15 PB of compressed cold data, cut disk usage on affected clusters from 80% to 7%, and improved p90 latency by ~30%.
Behind the Scenes: Evolving Netflix's Ads Event Pipeline for Live, Part II
Netflix's Ads Event Publisher used to enrich each client ad event by looking up metadata the ad server had written to a globally replicated key-value registry. For live events with tens of millions of concurrent viewers, that meant must-succeed database writes on the ad-serving critical path, a store that couldn't safely be scaled mid-event, and late events whenever lookups slowed. Netflix replaced it with an Apache Flink job: the ad server logs its responses to Kafka, and a custom KeyedCoProcessFunction joins them to client events over a 60-minute window, which catches roughly 99.999% of events. An hourly Spark job orchestrated by Maestro recovers the rest from the data warehouse. Revenue-bearing events are de-duplicated in local Flink state keyed by a hashed event ID. Both pipelines ran side by side with automated audits, and a stable per-event key moved publishing to Flink a slice at a time, region by region. When they agreed on well over 99.99% of events, Netflix retired the legacy service and the registry. In a load test, one AWS region handled an ad break at hundreds of thousands of events per second.
Inside Hyperdrive: How we solved a rare Hyperdrive MySQL caching bug
Hyperdrive, Cloudflare's distributed connection pooler for Workers, keeps warm database connections on its network and can cache common query results in the CDN cache. Taking its MySQL support from beta to GA meant finding bugs like utf8 being a 3-byte alias (fixed with utf8mb4) and COM_RESET_CONNECTION silently resetting the charset to the server default. The hardest was an empty-result bug seen by the highest-volume MySQL customer in about 0.001% of queries, only with caching on. Each Hyperdrive instance has a Client node next to the Worker and an Endpoint node near the database, and they share a cache when they run in the same data center. Because drivers like Node's mysql2 don't support CLIENT_DEPRECATE_EOF, the Client rewrites results into the Worker's capabilities, so the two nodes were caching different bytes for the same query and could read each other's entries. Caching one canonical encoding no matter which node stores it fixed the bug, and Client connection success reached 99.99%.
Meta's Generative Ads Model (GEM): Scaling the Central Model and Compute Engine for Frontier Ads AI
Meta replaced separate per-surface ad prediction systems with GEM, one central recommendation foundation model trained across all of its ad surfaces. A new LLM-style architecture (Kunlun) showed LLM-like scaling with 2.5x more model complexity, while custom low-precision kernels and 5D parallelism doubled end-to-end training efficiency to 20-25% MFU at 4x the training FLOPs across thousands of GPUs. Post-training transfer (LoopFM) and elastic pre-computation (Solaris) pass GEM's gains to real-time serving models without extra latency.
Under the hood, off the hot path: how D1 scales to millions of databases
How Cloudflare's D1 keeps query execution at the edge while a separate control plane manages millions of SQLite databases.
Scaling Git for the agentic software factory
GitLab is building next-gen source control for thousands of concurrent AI agents working on large repositories. With conventional Git, a single agent invocation can mean 5 to 10 GB of data transfer and more than 30 seconds of setup just to answer one question. Next-gen SCM keeps the Git protocol but runs stateless compute that scales horizontally against shared object storage, including S3-compatible storage customers control, and lets agents request only the files and history they need instead of cloning whole repos. In early internal tests, workloads ran up to 50x faster with up to 1,000x less network traffic, which GitLab calls peak results it is still validating. It also notes CI is the next bottleneck: GitLab.com customers created 40% more pipelines and pushed 50% more code over the past year.
Shipping Media Over QUIC at Meta Scale for Instagram Live Ingest
Instagram Live ingest moved from Meta's in-house RUSH protocol to the open IETF Media over QUIC standard on iOS and Android. Edge endpoints translate MoQ frames into the RUSH format, so the backend did not change. Server-side routing let the experiment resize in minutes, the transport falls back to TCP when UDP is blocked, and the launch matched RUSH on quality and reliability.
Building Git infrastructure for agent-scale development
GitHub explains why agent workloads strain Spokes, which keeps five durable copies of each repo on fileserver disks, so every added read replica slows writes. The new design coordinates only the ref update, moves compaction and GC to separate workers, and separates storage from compute: Azure Blob Storage holds the authoritative data while lightweight caching workers serve reads.
Inside branch-based restores in Lakebase Postgres
Traditional managed Postgres PITR provisions a new compute+disk monolith, pulls a snapshot out of object storage, and replays WAL—hours at large size—while a survey Neon cites of 50 production Postgres developers found 30% down 3+ hours after a critical failure. Lakebase splits compute from durable history: safekeepers quorum-ack WAL, a pageserver materializes page versions, and object storage keeps immutable history, with 99.99999% of reads served from local caches. A restore is then a metadata branch at a timestamp rather than a copy-and-replay, so time-to-restore drops to seconds even for a 100 TB database.
Rapidly scaling online storage to serve over 1 billion ChatGPT users
OpenAI's Habitat storage platform grew from a Python client library over Cosmos DB into a central service handling 70M+ requests per second. The team ran many low-concurrency Python processes to keep asyncio delay down, switched aiohttp connection reuse from LIFO to FIFO to stop a metastable failure, used Envoy for connection fan-in, kept a deliberately simple NoSQL API, then rewrote the service in Rust.
118 million queries per second on Neki
PlanetScale benchmarked Neki, its sharded Postgres, with single-shard primary-key point selects. Targeting about 200K QPS per shard, it went from 5 shards (about 1M QPS) to 50 (9.9M QPS, per-shard rate within 0.8%) to 512 shards and 480 routers, sustaining 118.5M QPS for 16 minutes over 1.22 PiB with a p99 of 6.06 ms at the router and about one error per 1.8 million queries. PlanetScale notes the run was read-only, primary-only with no replicas, and had no failover during the measured window.
From Homegrown to Flink: Migrating a Stateful Ad Event Join at Scale
Zalando Marketing Services replaced a 7-year-old homegrown in-memory join that matched Sponsored Products auction bids to clicks/views within 15 minutes. The old Java service read up to 200 MB/s, could not partition both streams cleanly, and lost up to 15 minutes of state on every deploy or rescale. After Interval Join burned 15-30% CPU on RocksDB seeks and held a ~70M-entry timer queue, they rewrote the match with KeyedCoProcessFunction (point lookups, RocksDB TTL expiry), incremental 3-minute checkpoints, and two-way state. A four-week shadow pipeline hit 99.9% enrichment parity, then a one-week A/B test; average pods fell from 20 to about 5, memory from ~320 GB to ~100 GB, and EC2 cost from about €80 to €30 per day, with enrichment up ~0.5%.
Agent platform (Part 1): How we help Grab build and run AI agents at scale
Grab's internal AI agent work started as a Tech Infra support bot and grew into a company-wide platform: more than 500 services run on its agent framework (LLM-Kit), over 50 Model Context Protocol servers are registered on its remote MCP framework, and a single LLM gateway fronts every model call across the company, handling billions of tokens each month for production agents used daily by millions of merchants, drivers, and consumers. Part 1 covers how the original Go bot's reasoning plane and tool plane became reusable framework building blocks, and how problems that appeared around 500 agents—shared model control, safe tool reuse across teams, and evals after prompt changes—pushed the team toward the GrabGPT Gateway, remote MCP, and an evals platform covered in later parts.
Session revocations at scale
Canva keeps 12 hours of session revocations in memory on every gateway, but hundreds of pods each loading over a million revocations from MySQL on deploy caused a stampede on the database. A worker now packs revocations into sorted 16-byte records in 30-minute chunks on S3, using conditional PUTs for optimistic concurrency and ZooKeeper leader election to avoid conflicts, and reaches over 2,000 revocations per second. Gateways binary-search the downloaded bytes directly and poll with conditional GETs, which shrank the cache by 87.5% and cut the revocation database down to two read replicas kept for redundancy.
Client-Side Load Balancing at a Million Requests Per Second
Zalando moved the internal fan-out of its Product Read API off the shared Skipper ingress into an in-process JVM load balancer that rebuilds the same xxHash64 consistent-hash ring. They added N-ring fade-in so new pods warm only the products they will keep, bounded load based on occupancy (Little's Law) weighted by latency, and a capped ring walk. Pods ran more evenly, the autoscaler target rose from 50% to 65% CPU, and the fleet shrank by over 25%.
When failover isn't safe: Building high-availability PostgreSQL on Kubernetes
A gameday that injected network latency into one availability zone left several of Datadog's Kubernetes-based PostgreSQL clusters stuck: replicas lagged past Patroni's maximum_lag_on_failover, so no standby could be promoted safely. Datadog moved to a hybrid model: standbys in the leader pool take part in synchronous replication (one synchronous standby, synchronous_mode_strict, synchronous_commit=remote_apply) while read replicas stay asynchronous. pgbench showed remote_apply raised average latency by 53% and cut throughput by 34%, yet production clusters saw no measurable impact after a gradual rollout, and synchronous replication is now enabled in all of its clusters.
We replaced Redis with MySQL for inventory reservations—and it scaled
Shopify moved checkout inventory reservations from Redis to MySQL using one row per sellable unit, a bounded pool of 1,000 rows per item/location and SELECT ... FOR UPDATE SKIP LOCKED. The real ceiling was connections held by other checkout code: tagging SQL by business process and measuring hold time in ProxySQL found it, and the cleanup removed 50% of reads and 33% of transactions on the primary.
How Discord Automates ScyllaDB Clusters at Scale
Discord's 7-person persistence team replaced fragile Python and bash scripts with the Scylla Control Plane, a Rust framework of idempotent tasks with declared preconditions, composed into YAML workflows. Jobs batch nodes by availability zone with concurrency limits to protect quorum, store their state in SQLite so they resume after interruptions, and send a webhook alert on unrecoverable errors. Operations like standing up shadow clusters and rolling upgrades went from a day and a half of babysitting to under two hours.
How OpenAI delivers low-latency voice AI at scale
OpenAI rebuilt its WebRTC stack for ChatGPT voice and the Realtime API after one-port-per-session media termination collided with Kubernetes: large public UDP ranges, sticky ICE/DTLS ownership, and global first-hop latency. A lightweight Go relay exposes a small fixed UDP surface, reads ICE ufrag routing hints from the first STUN packet, and forwards opaque media to the transceiver that owns ICE, DTLS, and SRTP state (with Redis-backed recovery). Cloudflare geo and proximity steering place signaling near users while Global Relay shortens the first media hop, preserving standard WebRTC for clients without making inference backends WebRTC peers.
When upserts don't update but still write: Debugging Postgres performance at scale
Datadog tracks last-seen time for millions of ephemeral hosts so inactive ones can be deleted after 7 days. An ON CONFLICT DO UPDATE upsert meant to touch each host at most once a day still locked the conflicting row and wrote Heap LOCK plus COMMIT WAL records even when the WHERE clause skipped the update—at 500 upserts/sec that roughly doubled write IOPS and quadrupled WAL syncs, and at 25,000/sec it would overwhelm a single writer. Using pg_walinspect and a debugger on heap_lock_tuple, they replaced it with an ON CONFLICT DO NOTHING CTE plus a conditional UPDATE that generates no WAL on true no-ops, keeps HOT updates when a day has passed, and preserves correctness for coarse host tracking.
Scaling PostgreSQL to power 800 million ChatGPT users
OpenAI runs ChatGPT on a single-primary Postgres with nearly 50 global read replicas. Reads are offloaded, write-heavy shardable workloads move to Cosmos DB, and PgBouncer, cache leasing and multi-layer rate limits keep the primary safe.
Contributing to Debezium: Fixing Logical Replication at Scale
Zalando's Fabric Event Streams provisions Debezium-in-embedded micro-apps so teams declare Postgres-sourced Kafka streams on Kubernetes; at peak the connectors handle hundreds of thousands of events per second across 100+ clusters, and have processed billions of events since 2018. Uncontrolled WAL growth on low-activity databases was the top operational issue until a pgjdbc keepalive flush advanced replication slots without table traffic. When newer Debezium hard-disabled that flush, Zalando contributed lsn.flush.mode (including connector_and_driver) and offset.mismatch.strategy (including trust_slot / trust_greater_lsn) so operators can opt into keepalive flushes while choosing whether the slot or the offset store wins on restart—both shipped in Debezium 3.4.0.Final.
Scaling real-time file monitoring with eBPF: How we filtered billions of kernel events per minute
Datadog's eBPF-based file integrity monitoring sees more than 10 billion file events per minute, and at about 5 KB each, shipping them all would mean terabytes per second. Agent-side rules cut what goes upstream to roughly one million events per minute, and moving evaluation into the kernel stops the ring buffer from overflowing: static approvers compiled from detection rules let matching events through, while runtime discarders stored in LRU eBPF maps drop values no rule can match. Together they pre-filter up to 94% of events in the kernel with no dropped events.
Haydex: From Zero to 178,600,000,000 rows a second in 30 days
Axiom turned a failed filter-index prototype into a production system for its event store, letting queries skip data and scan 178.6B rows per second.
Evolving our real-time timeseries storage again: Built in Rust for performance at scale
Datadog rebuilt its real-time timeseries database (RTDB) storage engine in Rust as Monocle after outgrowing Cassandra, Redis, MDBM, and a Go B+ tree plus a separate RocksDB path for DDSketch distributions. The design shards the keyspace early with a shard-per-core model (for example, 24 storage shards on a 32-core machine), ingesting from Kafka partitions over MPSC channels into per-shard LSM trees on single-threaded Tokio schedulers, with tiered compaction, a unified series cache, and permit- and cost-based query throttlers (including CoDel). At peak scale the rewrite delivered a 60x increase in ingestion performance and 5x faster queries, turning extreme outliers that used to take minutes into results that return in seconds.
Migrating the Jira Database Platform to AWS Aurora
Atlassian migrated about four million Jira databases from RDS Postgres to Aurora, balancing reliability, downtime and cost.
Breaking up a monolith: How we're unwinding a shared database at scale
Datadog is splitting its large shared Postgres database into team-owned instances in three phases. Logical separation moves tables into about 30 private domain schemas with explicit ACLs, using query samples and interviews with 30+ teams. Access reduction routes services through per-team PG Proxies so ACLs can be narrowed safely, and physical separation replicates each schema to a managed OrgStore instance, moves reads first and then writes with under five seconds of downtime, and replicates back for rollback. Two workloads have fully migrated and more than 70 dead tables were deleted along the way.
Achieving relentless Kafka reliability at scale with the Streaming Platform
Datadog treats Kafka as commodity hardware behind a Streaming Platform control layer. Streams span multiple Kafka clusters, AZs, and Kubernetes clusters so producers and consumers talk to stable identifiers while the control plane redirects traffic to healthier topics in seconds—for incidents, rebalancing, decommissioning, or repartitioning—without app redeploys. A custom Assigner replaces Kafka's group coordinator for multi-cluster rebalancing in seconds; Stream lanes isolate QoS and park poison pills in a DLQ; an enriched commit log tracks multiple offset ranges plus timestamps so consumers can process live traffic while replaying backlogs and the control plane can compute wall-clock lag across millions of partitions. After zstd "bombs" crashed stock clients, Datadog wrote libstreaming in Rust (with Java/Go/Python bindings) for unified, high-throughput access without a proxy in the TB/s data path.
How we sped up Notion in the browser with WASM SQLite
Notion cached data in the browser with WASM SQLite and OPFS, improving page navigation times.
Building and scaling Notion's data lake
Notion replaced slow warehouse syncs with a CDC pipeline (Debezium to Kafka to Hudi on S3) processed with Spark.
Timeseries indexing at scale
Datadog redesigned its timeseries indexing to handle a large jump in ingested data.
How Meta trains large language models at scale
Meta covers the hardware, networking and reliability work needed to train LLMs across very large GPU clusters.
How we improved push processing on GitHub
GitHub broke one huge push-processing job into smaller, independently retried jobs driven by Kafka events.
How Stripe's document databases supported 99.999% uptime with zero-downtime data migrations
Stripe's DocDB and its Data Movement Platform move data between shards without downtime.
How Figma's Databases Team Lived to Tell the Scale
Figma's nine-month effort to horizontally shard its Postgres stack using a custom query proxy and logical sharding before physical splits.
Horizontally scaling the Rails backend of Shop app with Vitess
Shopify's Shop app adopted Vitess to shard its Rails backend, covering keyspace design and the migration plan.
Upgrading GitHub.com to MySQL 8.0
How GitHub upgraded its whole MySQL fleet to 8.0 with staged replicas and a working rollback path.
How We Scaled PostgreSQL to 350 TB+
Timescale dogfooded its own Postgres extension to build a database-observability product, using hypertables, columnar compression and tiered storage to keep a 350 TB+ dataset queryable.
Supavisor: Scaling Postgres to 1 Million Connections
Supabase load-tested Supavisor, its Elixir Postgres pooler, with a million client connections.
The Great Re-shard: adding Postgres capacity (again) with zero downtime
Notion tripled its Postgres fleet by re-sharding with logical replication and careful PgBouncer cutovers, with no downtime.
Real-time Messaging
An overview of Slack's channel and gateway servers that fan messages out to millions of connected clients in real time.
The growing pains of database architecture
How Figma moved from one Postgres instance to multiple databases by vertically partitioning table groups.
How Discord Stores Trillions of Messages
Discord moved its message store from Cassandra to ScyllaDB and put Rust data services in front of it to coalesce hot-partition requests.
Husky: Exactly-once ingestion and multi-tenancy at scale
A deep dive on how Husky routes, shards and ingests events exactly once across tenants.
How we built Pingora, the proxy that connects Cloudflare to the Internet
Cloudflare replaced Nginx with Pingora, a Rust proxy that reuses connections better and needs less CPU and memory.
Log analytics using ClickHouse
Cloudflare moved its error-log pipeline to ClickHouse and shares schema and query lessons.
One million queries per second with MySQL
PlanetScale benchmarked a horizontally sharded Vitess cluster up to one million QPS.
We are splitting our database into Main and CI
GitLab.com split CI tables into their own Postgres database to relieve its main database.
Introducing Husky, Datadog's third-generation event store
Datadog's Husky is a distributed, schemaless column store that keeps event data on object storage.
Switching from etcd to SQLite: A Database Migration Story
Tailscale replaced etcd with SQLite plus Litestream replication for a simpler control-plane datastore.
LiveGraph: real-time data fetching at Figma
Figma built LiveGraph, which tails the Postgres replication log so its UI can subscribe to live query results.
Herding elephants: Lessons learned from sharding Postgres at Notion
Notion split its Postgres monolith into a fleet of logical shards keyed by workspace, using double-writes and backfills to migrate.
Why we spent the last month eliminating PostgreSQL subtransactions
GitLab traced replica stalls to Postgres subtransaction overflow and removed subtransactions from its code.
Partitioning GitHub's relational databases to handle scale
GitHub defined schema domains and linted cross-domain queries so it could move table groups onto separate MySQL clusters.
Shard Balancing: Moving Shops Confidently with Zero-Downtime at Terabyte-scale
Shopify rebalances MySQL shards by moving individual shops online with its Ghostferry tool.
ZippyDB: Facebook's key value store
Meta's general-purpose distributed key-value store built on RocksDB, with shard management and configurable consistency.
Read Consistency with Database Replicas
Shopify routes reads to MySQL replicas while giving apps consistency guarantees such as monotonic reads.
Capacity Planning at Scale
How Shopify plans and checks capacity for traffic peaks like BFCM using forecasts and scalability tests.
Scaling Datastores at Slack with Vitess
Slack's multi-year migration from active-active MySQL pairs to Vitess, so data could be sharded by any key, not only workspace.
Introducing Quicksilver: Configuration Distribution at Internet Scale
Quicksilver replicates Cloudflare's config key-value store to every edge server in seconds, built on LMDB.
Why Discord is switching from Go to Rust
Discord rewrote its Read States service from Go to Rust to get rid of garbage-collection latency spikes in a large in-memory cache.
How we optimized Magic Pocket for cold storage
Dropbox added a cold tier to Magic Pocket that cuts replication overhead for rarely read data.
Goodbye Microservices
Segment folded more than 100 destination microservices back into a monolith to cut operational overhead.
How Mozilla's Rust dramatically improved our server-side performance
Figma rewrote its multiplayer server in Rust to cut latency and memory use as documents and users grew.
HTTP Analytics for 6M requests per second using ClickHouse
Cloudflare rebuilt its HTTP analytics pipeline on ClickHouse, replacing a Postgres/Citus setup.
How Discord Scaled Elixir to 5,000,000 Concurrent Users
Discord tuned its Elixir guild processes and fan-out paths, building custom libraries to push events to millions of concurrent users.
Flannel: An Application-Level Edge Cache to Make Slack Scale
Slack added Flannel, an edge cache that serves user and channel data lazily so huge teams no longer need giant boot payloads.
Scaling your API with rate limiters
The four kinds of rate limiters and load shedders Stripe uses to protect its API.
How Discord Indexes Billions of Messages
Discord built message search on many small Elasticsearch clusters, sharding by guild and indexing lazily through a queue.
Online migrations at scale
Stripe's four-step dual-write playbook for migrating data models without downtime.
How Discord Stores Billions of Messages
Early story of Discord outgrowing MongoDB and moving messages to Cassandra with a channel+time-bucket partition key.
FollowFeed: LinkedIn's Feed Made Faster and Smarter
LinkedIn moved its feed to a fan-out-on-read system that keeps member timelines in memory and on RocksDB.
Stack Overflow: The Architecture - 2016 Edition
A tour of how Stack Overflow serves a huge site from a small number of powerful servers with heavy caching.
Running Kafka At Scale
How LinkedIn runs Kafka as its central data pipeline, including cluster tiers and mirroring between datacenters.
TAO: The power of the graph
TAO is Facebook's geo-distributed graph cache over sharded MySQL, serving the social graph at more than a billion reads per second.
Scaling to exabytes and beyond
Dropbox built Magic Pocket, its own exabyte-class block store, and moved user data off third-party cloud storage.
How we migrated Dropbox from Nginx to Envoy
Dropbox moved its edge traffic proxy from Nginx to Envoy for better observability and extensibility.
Rewriting the heart of our sync engine
Dropbox rewrote its desktop sync engine in Rust with a new data model built for correctness and testability.