Comparison
Cascading failurevsFailure domain
Cascading failure
one service got slow, its callers filled up with waiting requests, and the failure walked all the way up to the front door.
Failure propagating between components as each one's resources are consumed waiting on the last. It is why a non-critical dependency can cause a full outage: the criticality is in the coupling, not the feature. Timeouts, bulkheads, circuit breakers and shedding all exist to break the propagation path.
Full entry →Failure domain
one region went down and you found out which of your services quietly lived only in that region.
The set of things that fail together when one thing fails. Drawing them is how an availability argument becomes concrete: a shared database, an availability zone, a single deployment pipeline and one overloaded team are all failure domains, and the last two do not appear on the architecture diagram. The design question is never 'can this fail' but 'when it does, what is inside the boundary with it'.
Full entry →