We use analytics cookies.We use cookies to analyze site traffic and improve your experience.
Loading...
System Design Masterclass · Reliability Resilience
Free preview: the first 2 parts of this 7-part lesson.
Already bought the course? Sign in to read the whole lesson.
this lesson is part of
System Design Masterclass
Unlock this lesson and the 751 other paid lessons
$25 once, by PayPal
See the System Design courseread the rest of this lesson in
System Design Masterclass
Unlock this lesson and the 751 other paid lessons
$25 once, by PayPal
See the System Design coursein Reliability Resilience
This lesson is part of the full System Design Masterclass. Unlock it along with 769 other lessons for a one-time payment.
One-time payment by card or PayPal
Get Lifetime AccessOne-time payment: UPI, card or netbanking
Get Lifetime Access18 Foundation lessons are free, no payment needed. Try them now
It is easy and good
“It is really nice and good Please join the course”
Your recommendation service just died. What does the user see?
Option A: a blank page with a 500 error. Option B: the page loads with the product title, price, and images intact, but the "you might also like" section is missing. Every user on the planet prefers option B. That preference is the entire argument for graceful degradation.
Netflix's home page assembles data from over 100 . If every one of those services had to succeed for the page to render, Netflix would show error pages multiple times per day. Instead, every dependency has a fallback. Recommendations die? Show the global Top 50. Artwork ranking dies? Show the default thumbnail. Row personalization dies? Show editorial picks. The user sees a slightly worse page instead of no page at all.
Amazon's product pages follow the same principle. The "customers also bought" section, the dynamic pricing widget, and the review summary all come from separate services. If any of them fail, the product page still renders with the core data: title, price, availability, and the buy button. Jeff Bezos reportedly said that a customer who sees a working page with missing recommendations is a customer who might still buy something. A customer who sees a 500 error is gone.
Graceful degradation is the discipline of deciding, before any incident, what your system can live without and building the fallback paths to prove it.
Every component in a graceful degradation strategy exists in one of three states. The transitions between states are what the engineering team designs in advance.
| State | What the User Sees | What the System Does |
|---|---|---|
| Healthy | Full experience, all features present | All services responding within SLO |
| Degraded | Most features present, some missing or simplified | Failed services replaced by fallbacks, feature flags flipped |
| Emergency | Core flow only (login, checkout, payments) | Everything non-critical disabled, serving from cache |
The distinction between degraded and emergency is not academic. Degraded mode is business as usual at Netflix. It happens multiple times a day across their fleet and users rarely notice. Emergency mode is rare, maybe once or twice a year, and it means something fundamental is broken enough that only the revenue-critical path survives.
The fallback for each component must be pre-computed. A fallback that requires computation at failure time inherits the same dependency problems that caused the original failure. Netflix warms a global Top 50 cache from a healthy cluster every 60 seconds so that when personalization dies, the cache is already sitting there ready to serve.