Comparison
Blast radiusvsFailure domain
Blast radius
you ask how much of the product breaks if this one component dies, and design so the answer is not "all of it".
The scope of impact when a given component fails. Reducing it is the point of cells, shards, bulkheads and per-tenant isolation. It is also the right frame for reviewing a change: not "will this break" but "what breaks with it".
Full entry →Failure domain
one region went down and you found out which of your services quietly lived only in that region.
The set of things that fail together when one thing fails. Drawing them is how an availability argument becomes concrete: a shared database, an availability zone, a single deployment pipeline and one overloaded team are all failure domains, and the last two do not appear on the architecture diagram. The design question is never 'can this fail' but 'when it does, what is inside the boundary with it'.
Full entry →