Netflix System Design
Playback
The most common follow-up after drawing the architecture. Walk through every hop with latency budgets. Emphasize that API servers never touch video bytes.
Press Play — 16-Step Sequence
Instead of reading this as one long line, think in four interview-friendly phases: request enters, checks run in parallel, response comes back, then the streaming loop continues off the API critical path.
Request Enters
Steps 1–4Client request reaches the playback backend and the orchestration fan-out begins.
POST /playback/session { titleId, episodeId, deviceId, drmScheme }
DNS resolve + load balance to nearest healthy API server
Validate JWT signature, rate-limit check, route to Playback Service
Receives request — begins parallel fan-out to 4 services simultaneously
Parallel Checks
Steps 5–9Entitlement, stream slot, OCA ranking, and DRM license happen in parallel.
Check entitlement cache: is account active? which plan?
Cache MISS only: entitlement falls through to billing data on a MySQL read replica. Cache hit rate stays above 99%.
Redis Lua script: atomically check slot count ≤ plan limit, INCR, SADD sessionId, TTL=36s
Get ranked OCA list for client IP: ASN match + title cached + OCA health + load
Issue license token signed by HSM (Content Encryption Key wrapped for device TEE)
Response Out
Steps 10–13Manifest URL is built, async writes are kicked off, and the client gets everything needed to start.
Build signed HMAC-SHA256 manifest URL (6h TTL) pointing to chosen OCA
Write session to Cassandra — ASYNC, off critical path
Publish playback.started to Kafka — ASYNC, off critical path
Receives signed manifest URL ← TOTAL API time ends here
Streaming Loop
Steps 14–16Video bytes come from OCA, and heartbeats keep the session alive without blocking playback.
Fetch DASH/HLS manifest, then download video segments — API tier COMPLETELY out of path
POST /playback/heartbeat { sessionId, positionMs, bitrateKbps, bufferMs }
Refresh Redis slot TTL to 36s + async Cassandra position write
Critical path
Steps 1 → 13
The API latency budget ends when the signed manifest URL comes back.
Parallel fan-out
Steps 5 → 9
These checks happen together, so interviewers expect you to talk about the max latency, not the sum.
Streaming tier
Steps 14 → 16
After playback starts, video bytes come from OCA and backend mostly handles heartbeats plus session TTL refreshes.
Latency Budget Breakdown
Failure Behavior
Every downstream dependency has a defined failure mode. Interviewers test this.
Use cached entitlement (EVCache TTL = 1h) for active paying users. Fail closed only for new or suspicious sessions with no cached state.
Why: Netflix would rather give away one play than block 60M concurrent users during a billing outage.
Return HTTP 503 to client. No plaintext fallback is allowed — studio licensing contracts require this.
Why: Content protection is a legal contractual requirement, not a reliability choice.
Playback continues unaffected. Resume position may be slightly stale. Next heartbeat will update position.
Why: Watch history is eventually consistent by design. Slightly stale resume is acceptable.
Player falls back to next OCA in the ranked list. If all ISP OCAs unhealthy, Exchange OCA, then S3 origin.
Why: OCA selection returns 3–5 candidate nodes. Client retries down the list automatically.
Concurrency slot self-expires after 36s TTL if no heartbeat arrives. Player retries heartbeat independently.
Why: 36s TTL > 30s heartbeat interval provides 1 missed heartbeat grace period before slot eviction.
Redis Lua script is atomic. Race condition impossible — only one device wins the slot INCR. Loser gets 429.
Why: Atomicity at the Redis layer eliminates the race without distributed locks.