How teams scaled PostgreSQL: 19 real case studies
19 of the 94 engineering write-ups in our database mention PostgreSQL in their stack. They come from 11 companies (Datadog, Figma, PlanetScale, GitLab, Notion and 6 more) and were published between 2021 and 2026. Techniques that show up most often alongside PostgreSQL: connection pooling (3), horizontal sharding (3), query optimization (3) and read replicas (3). It's often paired with AWS RDS (4), Kubernetes (4), Neki (3) and PgBouncer (3). 12 of the 19 state concrete scale numbers, for example "one primary and multiple replicas per shard" (PlanetScale). Each card below links to our short summary and the original post.
Where to start: how OpenAI scaled PostgreSQL for ChatGPT on a single primary, Figma's Postgres sharding project, and PlanetScale's 118.5M QPS sharded Postgres benchmark. Running Postgres on AWS? See PostgreSQL on AWS RDS, plus Atlassian's move from RDS to Aurora.
Designing a planned switchover for minimum disruption
When a Neki shard's primary has to step aside for a pod replacement, kernel upgrade or cell move, PlanetScale does a planned switchover instead of stopping Postgres the way Patroni does, so a failed switchover can quickly fall back to the old primary. Admin, Neki's control plane, first validates shard state, the target replica, logical failover slots and Postgres settings. Routers then proactively buffer primary-bound queries, the primary defaults new transactions to read-only, and the other replicas are disconnected to pin a final WAL position the target must replay. If the target can't catch up before a deadline, a config reload makes the old primary writable again. Buffered queries are replanned against the new primary, so apps see added latency instead of errors, and every acknowledged commit is on the target when it is promoted.
Shard design doesn't start from your tables
In Neki, PlanetScale's sharded Postgres, a shard group is the unit of co-location: tables in the same group that hash their shard key the same way (xxhash into a 64-bit keyspace split by key ranges) always land on the same shard. Sharding customers, orders, items and addresses by customer_id keeps single-customer queries and transactions on one shard, which matters because a transaction across two shards gets no atomic commit or shared snapshot. Lookup tables become reference tables copied to every shard, catalog tables get their own group keyed on lower(sku), range and modulo indexes support legacy schemes, and a global secondary index routes queries like orders by id without fanning out. Shard groups can be changed later with the Reshard workflow.
Inside branch-based restores in Lakebase Postgres
Traditional managed Postgres PITR provisions a new compute+disk monolith, pulls a snapshot out of object storage, and replays WAL—hours at large size—while a survey Neon cites of 50 production Postgres developers found 30% down 3+ hours after a critical failure. Lakebase splits compute from durable history: safekeepers quorum-ack WAL, a pageserver materializes page versions, and object storage keeps immutable history, with 99.99999% of reads served from local caches. A restore is then a metadata branch at a timestamp rather than a copy-and-replay, so time-to-restore drops to seconds even for a 100 TB database.
118 million queries per second on Neki
PlanetScale benchmarked Neki, its sharded Postgres, with single-shard primary-key point selects. Targeting about 200K QPS per shard, it went from 5 shards (about 1M QPS) to 50 (9.9M QPS, per-shard rate within 0.8%) to 512 shards and 480 routers, sustaining 118.5M QPS for 16 minutes over 1.22 PiB with a p99 of 6.06 ms at the router and about one error per 1.8 million queries. PlanetScale notes the run was read-only, primary-only with no replicas, and had no failover during the measured window.
When failover isn't safe: Building high-availability PostgreSQL on Kubernetes
A gameday that injected network latency into one availability zone left several of Datadog's Kubernetes-based PostgreSQL clusters stuck: replicas lagged past Patroni's maximum_lag_on_failover, so no standby could be promoted safely. Datadog moved to a hybrid model: standbys in the leader pool take part in synchronous replication (one synchronous standby, synchronous_mode_strict, synchronous_commit=remote_apply) while read replicas stay asynchronous. pgbench showed remote_apply raised average latency by 53% and cut throughput by 34%, yet production clusters saw no measurable impact after a gradual rollout, and synchronous replication is now enabled in all of its clusters.
When upserts don't update but still write: Debugging Postgres performance at scale
Datadog tracks last-seen time for millions of ephemeral hosts so inactive ones can be deleted after 7 days. An ON CONFLICT DO UPDATE upsert meant to touch each host at most once a day still locked the conflicting row and wrote Heap LOCK plus COMMIT WAL records even when the WHERE clause skipped the update—at 500 upserts/sec that roughly doubled write IOPS and quadrupled WAL syncs, and at 25,000/sec it would overwhelm a single writer. Using pg_walinspect and a debugger on heap_lock_tuple, they replaced it with an ON CONFLICT DO NOTHING CTE plus a conditional UPDATE that generates no WAL on true no-ops, keeps HOT updates when a day has passed, and preserves correctness for coarse host tracking.
Scaling PostgreSQL to power 800 million ChatGPT users
OpenAI runs ChatGPT on a single-primary Postgres with nearly 50 global read replicas. Reads are offloaded, write-heavy shardable workloads move to Cosmos DB, and PgBouncer, cache leasing and multi-layer rate limits keep the primary safe.
Contributing to Debezium: Fixing Logical Replication at Scale
Zalando's Fabric Event Streams provisions Debezium-in-embedded micro-apps so teams declare Postgres-sourced Kafka streams on Kubernetes; at peak the connectors handle hundreds of thousands of events per second across 100+ clusters, and have processed billions of events since 2018. Uncontrolled WAL growth on low-activity databases was the top operational issue until a pgjdbc keepalive flush advanced replication slots without table traffic. When newer Debezium hard-disabled that flush, Zalando contributed lsn.flush.mode (including connector_and_driver) and offset.mismatch.strategy (including trust_slot / trust_greater_lsn) so operators can opt into keepalive flushes while choosing whether the slot or the offset store wins on restart—both shipped in Debezium 3.4.0.Final.
Migrating the Jira Database Platform to AWS Aurora
Atlassian migrated about four million Jira databases from RDS Postgres to Aurora, balancing reliability, downtime and cost.
Breaking up a monolith: How we're unwinding a shared database at scale
Datadog is splitting its large shared Postgres database into team-owned instances in three phases. Logical separation moves tables into about 30 private domain schemas with explicit ACLs, using query samples and interviews with 30+ teams. Access reduction routes services through per-team PG Proxies so ACLs can be narrowed safely, and physical separation replicates each schema to a managed OrgStore instance, moves reads first and then writes with under five seconds of downtime, and replicates back for rollback. Two workloads have fully migrated and more than 70 dead tables were deleted along the way.
How Figma's Databases Team Lived to Tell the Scale
Figma's nine-month effort to horizontally shard its Postgres stack using a custom query proxy and logical sharding before physical splits.
How We Scaled PostgreSQL to 350 TB+
Timescale dogfooded its own Postgres extension to build a database-observability product, using hypertables, columnar compression and tiered storage to keep a 350 TB+ dataset queryable.
Supavisor: Scaling Postgres to 1 Million Connections
Supabase load-tested Supavisor, its Elixir Postgres pooler, with a million client connections.
The Great Re-shard: adding Postgres capacity (again) with zero downtime
Notion tripled its Postgres fleet by re-sharding with logical replication and careful PgBouncer cutovers, with no downtime.
The growing pains of database architecture
How Figma moved from one Postgres instance to multiple databases by vertically partitioning table groups.
We are splitting our database into Main and CI
GitLab.com split CI tables into their own Postgres database to relieve its main database.
LiveGraph: real-time data fetching at Figma
Figma built LiveGraph, which tails the Postgres replication log so its UI can subscribe to live query results.
Herding elephants: Lessons learned from sharding Postgres at Notion
Notion split its Postgres monolith into a fleet of logical shards keyed by workspace, using double-writes and backfills to migrate.
Why we spent the last month eliminating PostgreSQL subtransactions
GitLab traced replica stalls to Postgres subtransaction overflow and removed subtransactions from its code.