We use analytics cookies.We use cookies to analyze site traffic and improve your experience.
Loading...
2 system design questions lean on this idea. Each walks through the full answer.
System Design Masterclass · Reliability Resilience
Free preview: the first 2 parts of this 7-part lesson.
Already bought the course? Sign in to read the whole lesson.
this lesson is part of
System Design Masterclass
Unlock this lesson and the 751 other paid lessons
$25 once, by PayPal
See the System Design courseread the rest of this lesson in
System Design Masterclass
Unlock this lesson and the 751 other paid lessons
$25 once, by PayPal
See the System Design coursein Reliability Resilience
This lesson is part of the full System Design Masterclass. Unlock it along with 769 other lessons for a one-time payment.
One-time payment by card or PayPal
Get Lifetime AccessOne-time payment: UPI, card or netbanking
Get Lifetime Access18 Foundation lessons are free, no payment needed. Try them now
It is easy and good
“It is really nice and good Please join the course”
Active-passive wastes half your infrastructure on a standby that does nothing until disaster strikes. Active-active eliminates that waste by running all instances live, all the time. Every node serves real traffic. When one dies, the others absorb its share without any promotion step, without any replication catch-up, and without any propagation delay.
Netflix runs active-active across three AWS regions. Every region serves real user traffic at roughly 33% capacity. When the December 2021 us-east-1 outage hit, the other two regions absorbed the extra load in under four minutes. No manual intervention. No pages. Users outside the US-East footprint noticed nothing.
The tradeoff is complexity. Active-passive has one writer and zero conflicts. Active-active has multiple writers and must handle the case where two regions modify the same data within the window. Conflict resolution is not optional; it is the defining engineering challenge. Teams that ignore it discover during a replication lag spike that two customers both bought the last item in stock and both got charged.
| Component | Role | Key Constraint |
|---|---|---|
| Global | Distributes traffic across all active instances by or geography | Must detect failures in under 30 seconds and stop routing to dead instances |
| Multiple active nodes | Every node accepts reads and writes simultaneously | Each node must have enough headroom to absorb extra traffic when a peer dies |
| Cross-instance | Propagates writes between all nodes with bounded lag | Replication lag determines the window where conflicts can occur |
| Conflict resolution | Handles concurrent writes to the same record from different nodes | Last-writer-wins, CRDTs, vector clocks, or single-writer-per-entity |
| Health monitoring | Continuously verifies each node and its dependencies | Deep health checks, not just pings |
Active-active turns failover into a non-event because there is no promotion and no traffic shift. The load balancer simply stops sending traffic to the dead node. The surviving nodes were already warm, already connected, already serving users. Failover time drops from minutes (active-passive) to seconds (active-active), bounded only by health check detection speed.