Comparison
Cell-based architecturevsFailure domain
Cell-based architecture
customers are divided across eight complete copies of the stack, so a bad deploy or a poison request takes out an eighth of them.
Partitioning the whole system into independent, complete instances and assigning each customer to one. It converts most total outages into partial ones and gives deployments a natural containment unit. The costs are operational multiplication — everything you do, you do eight times — and routing, since something has to map a customer to a cell and that router is now the shared dependency.
Full entry →Failure domain
one region went down and you found out which of your services quietly lived only in that region.
The set of things that fail together when one thing fails. Drawing them is how an availability argument becomes concrete: a shared database, an availability zone, a single deployment pipeline and one overloaded team are all failure domains, and the last two do not appear on the architecture diagram. The design question is never 'can this fail' but 'when it does, what is inside the boundary with it'.
Full entry →