Filter concepts by levelShowing all levels.

System Design · Priority Roadmap

What to learn, in what order, to what depth

Three tiers ranked by how often a topic decides a design — with a testable standard for each, because "master" and "working knowledge" mean nothing on their own

  • Tier 1 · 16 topicsusable with no reference, and correct about the failure mode
  • Tier 2 · 13 topicsrecognise it applies, design with it, look up the details
  • Tier 3 · 6 topicschoose a system that implements it; reason about the guarantee
  • Ranked by frequencynot by difficulty — tier 1 is where the failures come from

1.Tier 1 — the sixteen to master

Sixteen topics that appear in essentially every system you will ever build, which is what makes them tier 1: requirements, capacity estimation, APIs, data modeling, SQL, caching, queues, concurrency, transactions, consistency, availability, reliability, security, observability, scaling and trade-offs. "Master" needs a testable meaning or the tier is just an ordering. Here it means two things. First, you can use it without looking it up — not that you remember every option, but that you can produce a working design and the right vocabulary in a conversation, at a whiteboard, with no reference material. Second, and more demanding, you know the failure mode and not only the happy path. Anyone can describe a cache; mastering caching means knowing what a miss storm on a hot key does, and what a stale entry costs in the specific workflow you are caching. That second half is what separates tier 1 from having read about something. The list also has an internal order — requirements and capacity estimation come first because they produce the numbers every later decision is checked against, and trade-offs comes last because it is the skill of choosing between things you now understand well enough to compare. Getting all sixteen to that standard is a multi-year effort, and it is the difference between an engineer who can build a feature and one who can be handed a system.

Key features

  • Sixteen topics that appear in essentially every system, which is the criterion for tier 1
  • Master = usable without looking it up, and correct about the failure mode as well as the happy path
  • The failure-mode half is the demanding one: describing a cache is easy, knowing what a hot-key miss storm does is not
  • Requirements and capacity estimation come first — they produce the numbers every later decision is checked against
  • Trade-offs comes last because it is the skill of comparing things you already understand well
  • Reaching this standard across all sixteen is a multi-year effort, not a reading list

The sixteen, and the test that says you have it

The sixteen, and the test that says you have it
GroupTopicYou have it when you can…
Before you buildRequirementsSeparate functional from non-functional and turn a vague ask into measurable targets
Before you buildCapacity estimationGet from a business number to peak RPS, storage per year and connection count, out loud
Before you buildAPIsDesign a resource model with pagination, versioning and a stable error contract
Before you buildData modelingDerive a schema from access patterns and express each invariant as a constraint
The data layerSQLRead a query plan and say why an index is or is not being used
The data layerCachingName pattern, key, TTL and invalidation — and say what a miss storm on a hot key does
The data layerQueuesExplain at-least-once delivery and design a consumer that survives it
The data layerTransactionsSay what a transaction does and does not protect, and keep network calls out of one
Correctness under loadConcurrencySpot a read-then-write race and replace it with a conditional update
Correctness under loadConsistencyChoose a model per workflow and explain what the user sees under each
Correctness under loadAvailabilityConvert a nines target into a downtime budget and find the hidden single point of failure
Correctness under loadReliabilityDistinguish "up" from "correct" and design for partial failure
Running itSecurityPlace authentication, authorization and encryption at the right boundaries, per object
Running itObservabilityDefine a symptom-based alert per user-visible promise, and trace a request across services
Running itScalingName the first component to saturate, at what load, and why
Running itTrade-offsState any decision as benefit, cost, alternative and reason

Two levels of knowing, on the same topic

Two levels of knowing, on the same topic
TopicRead about itMastered it
CachingKnows cache-aside, read-through, write-throughKnows what happens when a hot key expires and 4,000 requests miss at once — and has a per-key lock in the design
QueuesKnows producers, consumers and dead-letter queuesAssumes at-least-once by default and makes the consumer idempotent without being asked
TransactionsKnows ACIDKnows the transaction holds locks for the duration of anything inside it, so a provider call never goes in one
AvailabilityKnows "three nines"Knows three nines is 43 minutes a month, and has checked whether one component makes it unreachable
Tier 1 — sixteen topics, in the order they get used

Before you build

Requirements

Capacity estimation

produces the numbers everything else is checked against

APIs

Data modeling

The data layer

SQL

Caching

Queues

Transactions

Correctness under load

Concurrency

Consistency

Availability

Reliability

Running it

Security

Observability

Scaling

Trade-offs

last, because it compares the other fifteen

  • Before you build
    • Requirements
    • Capacity estimation — produces the numbers everything else is checked against
    • APIs
    • Data modeling
  • The data layer
    • SQL
    • Caching
    • Queues
    • Transactions
  • Correctness under load
    • Concurrency
    • Consistency
    • Availability
    • Reliability
  • Running it
    • Security
    • Observability
    • Scaling
    • Trade-offs — last, because it compares the other fifteen

Command

text
Tier 1, in the order they get used

  BEFORE YOU BUILD
    requirements -> capacity estimation
    -> APIs -> data modeling

  THE DATA LAYER
    SQL · caching · queues · transactions

  CORRECTNESS UNDER LOAD
    concurrency · consistency
    availability · reliability

  RUNNING IT
    security · observability · scaling
    trade-offs

Master = usable with no reference material,
AND correct about the failure mode.

Sixteen topics that appear in every system: requirements, capacity estimation, APIs, data modeling, SQL, caching, queues, concurrency, transactions, consistency, availability, reliability, security, observability, scaling, trade-offs. "Master" means two things — usable with no reference material, and correct about the failure mode, not just the happy path. The second half is the demanding one and the one designs actually depend on. Tier 1 is ranked by how often it decides a design, not by difficulty: these are where nearly every real failure comes from.

2.Tier 2 — strong working knowledge

Thirteen topics you meet often but not always: Kafka and RabbitMQ, sharding, read replicas, distributed transactions, sagas, the transactional outbox, rate limiting, search, object storage, multi-tenancy, cloud services, Docker and Kubernetes, and disaster recovery. The standard here is lower than tier 1 and still specific. You must recognise when the topic applies, be able to design with it at a whiteboard, and know its main failure mode — but you may look up the configuration, the exact API and the operational details. So: you should be able to say that a workflow spanning two services needs a saga with compensating actions, sketch the steps and name what happens if a compensation fails, without remembering any particular framework's decorator syntax. The distinction that matters is recognition versus recall. Failing to recognise that you need an outbox produces a system that silently loses events; failing to recall the exact column types costs five minutes with the documentation. Tier 2 is also where most over-engineering originates, because each of these is genuinely powerful and adopting one without the requirement that justifies it imports its whole cost — Kafka brings partitions, consumer groups, rebalancing and lag monitoring whether or not you needed replay.

Key features

  • The standard: recognise when it applies, design with it, know its main failure mode — configuration and API details may be looked up
  • Recognition failures are expensive (a lost-event bug); recall failures cost five minutes of documentation
  • Tier 2 is where over-engineering starts — each topic is powerful, and adopting one imports its whole operational cost
  • Several are pairs with a default: RabbitMQ for task queues, Kafka for replayable logs; replicas before sharding, always
  • Docker and Kubernetes are packaging and scheduling, not architecture — they change how a design is deployed, not what it is
  • Disaster recovery is tier 2 only because it is rarely exercised; its RPO and RTO decisions are tier-1 conversations

The thirteen: what you must be able to do, and what you may look up

The thirteen: what you must be able to do, and what you may look up
TopicMust be able to (no reference)May look up
Kafka / RabbitMQSay which one a workload wants and why — replayable log versus task queueConsumer group config, exchange bindings, retention settings
ShardingChoose a shard key, and say what a cross-shard query costsRebalancing procedure, vendor-specific tooling
Read replicasDecide per workflow which reads tolerate lag, and how muchReplication setup and failover commands
Distributed transactionsExplain why two-phase commit is usually avoided and what it costsCoordinator protocol details
SagasSketch the steps, the compensations, and what happens when a compensation failsFramework or orchestrator syntax
Transactional outboxRecognise the dual-write problem and place the outbox row in the right transactionRelay implementation, CDC connector config
Rate limitingPick an algorithm and identity key, and make the check atomicExact script or library API
SearchSay when a database index is not enough, and keep the index derivedAnalyzer and mapping syntax
Object storageKeep bytes out of the app tier; scope signed URLs to one key and methodSDK calls, lifecycle rule syntax
Multi-tenancyChoose an isolation model and enforce it on every path, not just queriesRow-level security policy syntax
CloudChoose managed versus self-hosted with a stated reason, and know the cost surfaceService names, quotas, console navigation
Docker / KubernetesExplain what containers change about deployment — and what they do not change about architectureManifest fields, operator specifics
Disaster recoveryState RPO and RTO first, then let them choose the strategyRestore runbook steps

Four tier-2 topics that are usually adopted too early

Four tier-2 topics that are usually adopted too early
TopicThe requirement that justifies itWhat it costs without one
KafkaReplay, or multiple independent consumers of the same streamPartitions, consumer groups, rebalances and lag monitoring to run a task queue
ShardingOne primary genuinely cannot hold the write rate or the dataCross-shard queries, resharding, and a shard key you cannot change
Microservice-scale multi-tenancyCustomers with genuinely different isolation or compliance needsPer-tenant migrations and connection pools for a product with fifty users
KubernetesEnough services and scaling variance for scheduling to be a real problemA second system to operate, debug and upgrade, wrapped around three containers
The three tiers, ranked by how often each decides a design

Tier 1 — master (16 topics)

In every system. Usable with no reference, and correct about the failure mode.

Tier 2 — strong working knowledge (13 topics)

Often, not always. Recognise it applies, design with it, know its failure mode; look up the details.

Tier 3 — conceptual (6 topics)

Rare, or someone else's implementation. Know what problem it solves and when to reach for a system that has it.

  1. Tier 1 — master (16 topics) — In every system. Usable with no reference, and correct about the failure mode.
  2. Tier 2 — strong working knowledge (13 topics) — Often, not always. Recognise it applies, design with it, know its failure mode; look up the details.
  3. Tier 3 — conceptual (6 topics) — Rare, or someone else's implementation. Know what problem it solves and when to reach for a system that has it.

Command

text
Tier 2 — the standard, stated as a test

  Given a requirement, can you:
    1. name the tier-2 topic it needs?
    2. sketch the design on a whiteboard?
    3. say its main failure mode?
  Then you have strong working knowledge.

  Not required: config, API surface,
  operational runbooks. Look those up.

  The expensive failure is (1).
  Missing "this needs an outbox" loses
  events silently. Forgetting the column
  types costs five minutes.

Thirteen topics you meet often but not always. The standard is recognise, design, know the failure mode — configuration and API details may be looked up, because failing to recognise that a workflow needs an outbox loses events silently, while forgetting the column types costs five minutes. Tier 2 is also where over-engineering starts: each topic is genuinely powerful and adopting one without the requirement that justifies it imports its whole operational cost. Replicas before sharding, RabbitMQ for task queues, Kafka for replayable logs, and containers change deployment rather than architecture.

3.Tier 3 — conceptual and specialized

Six topics where understanding the idea is the goal and implementing it usually is not: consensus algorithms, multi-region active-active designs, advanced stream processing, custom storage engines, advanced scheduling, and specialized distributed databases. Conceptual is the right depth rather than a concession, because for five of the six the correct move in a real system is to use something that already implements it. You will not write Raft; you will choose etcd or a managed service and need to know what "a quorum of three" buys and what it costs in latency. You will not build a storage engine; you will need to know why a log-structured merge tree is fast at writes and pays for it at read time, so that you can predict how a database will behave under your workload. What you need is the vocabulary to choose well and to reason about a guarantee someone else implemented. The exception is multi-region active-active, which is conceptual for a different reason: it is not that you would use a library, it is that almost no system needs it, and the sections on multi-region systems and disaster recovery cover the decision. Being deep here while tier 1 is shallow is a recognisable pattern and a costly one, because tier-1 topics decide ten thousand times as many designs.

Key features

  • For five of the six, the right move in a real system is to use an existing implementation — so vocabulary and guarantees are the deliverable
  • Consensus: know what a quorum buys, what it costs in latency, and that you should reach for etcd or a managed service rather than implement it
  • Storage engines: knowing B-tree versus LSM behaviour predicts how a database performs on your workload
  • Multi-region active-active is conceptual for a different reason — almost no system needs it, and the requirement is the decision
  • Depth here while tier 1 is shallow is a recognisable and expensive pattern
  • A tier-3 topic becomes tier 1 for you the moment your job actually is that system — the ranking is about frequency, not importance

The six, and what conceptual depth actually means for each

The six, and what conceptual depth actually means for each
TopicWhy conceptual is enoughThe one thing to carry
Consensus algorithmsYou will use etcd, ZooKeeper or a managed service, not implement RaftA quorum needs a majority, so an even number of nodes buys nothing — and every write pays a round trip
Multi-region active-activeAlmost no system needs it; the requirement is the decisionTwo regions accepting writes means conflict resolution, which is a product question before it is a technical one
Advanced stream processingFrameworks own windowing, state and checkpointingEvent time is not processing time, and late data is normal rather than exceptional
Custom storage enginesYou choose a database; you do not write oneB-tree reads well and writes in place; LSM writes fast and pays at read and compaction time
Advanced schedulingKubernetes, cloud schedulers and job frameworks implement itFairness, priority and preemption are policies — defaults are a choice somebody already made for you
Specialized distributed databasesThe value is choosing the right one for a workloadEach buys one property (global order, geo-distribution, time series) and charges for it somewhere else

The recognisable inversion

The recognisable inversion
SymptomWhat it usually means
Can explain Raft; cannot state the service's peak RPSTier 3 studied, tier 1 assumed
Proposes active-active; has not written an RPO or RTOThe exotic answer arrived before the requirement
Compares LSM and B-tree in review; the schema enforces invariants in application codeDepth applied where it does not decide anything
Tier 3 — six topics you reason about rather than build

Consensus algorithms

use etcd or a managed service; know what a quorum costs

Multi-region active-active

conflict resolution is a product question first

Advanced stream processing

event time ≠ processing time; late data is normal

Custom storage engines

B-tree vs LSM predicts your database's behaviour

Advanced scheduling

fairness and preemption are policies, and defaults are choices

Specialized distributed databases

each buys one property and charges elsewhere

  • Consensus algorithms — use etcd or a managed service; know what a quorum costs
  • Multi-region active-active — conflict resolution is a product question first
  • Advanced stream processing — event time ≠ processing time; late data is normal
  • Custom storage engines — B-tree vs LSM predicts your database's behaviour
  • Advanced scheduling — fairness and preemption are policies, and defaults are choices
  • Specialized distributed databases — each buys one property and charges elsewhere

Command

text
Tier 3 — the test is different

  Tier 1:  can you use it, with no reference?
  Tier 2:  can you recognise it and design
           with it?
  Tier 3:  can you choose a system that has
           it, and reason about the guarantee
           it gives you?

  You will not write Raft. You will pick
  etcd and need to know that a quorum of 3
  survives 1 failure, that 4 nodes survive
  the same 1, and that every write costs a
  round trip to a majority.

Six topics where understanding is the goal and implementing is not — consensus, multi-region active-active, advanced stream processing, custom storage engines, advanced scheduling, and specialized distributed databases. For five of them you will choose an existing implementation, so the deliverable is vocabulary and the ability to reason about someone else's guarantee; multi-region active-active is conceptual because almost no system needs it. Being deep here while tier 1 is shallow is a costly and recognisable pattern — the tiers rank by how often something decides a design, so a tier-3 topic becomes tier 1 for you the day your job is that system.

Remember

  • Tier 1 is "always relevant", not "easy" — the depth ceiling on data modeling is higher than on consensus.
  • The failure mode is the second half of mastery, and it is the half a design depends on.
  • Tier 2 is where over-engineering starts: adopting one imports its whole operational cost.
  • Deep in tier 3 while shallow in tier 1 is a recognisable and expensive inversion.

Pro tip

  • Do not study tier 1 topic by topic — build a system that needs six at once, then break it on purpose.
  • A tier-3 topic becomes tier 1 for you the day your job actually is that system. The ranking is about frequency, not importance.

Next up

  • Recommended Learning Order
  • Twenty-nine steps, and why the order is not arbitrary
  • Then the final senior-level standard

Sources

  • System Design Primer · raft.github.io
  • Checked 2026-09-04

Spotted a mistake on this page? Tell us.