System Design: Netflix

Studio masters land in object storage; a playback API returns a URL; clients stream from cloud regions. The catalog is small — on the order of ~10K titles — so storage is trivial and this works for a pilot market.

Concurrency kills it: ~30M concurrent viewers at ~5 Mbps is on the order of ~150 Tbps of egress. At cloud bandwidth prices that is ruinous, and physics is worse — prime-time traffic crossing the public internet backbone means buffering exactly when everyone is watching. The bytes have to start closer to the viewer.

Before distribution, every title runs through an encoding pipeline: multiple codecs (AVC, HEVC, AV1) times a per-title bitrate ladder — analyze each title's complexity and pick encode points, because a flat cartoon needs far fewer bits than an action film at the same quality. Add localization: subtitle tracks and audio dubs per region.

Every rendition is then packaged under DRM (Widevine, FairPlay, PlayReady for different device families). Tens of renditions per title pushes the encoded catalog into the tens of PB — still small enough that the entire popular catalog can be replicated to the edge, which is the insight the next step cashes in.

Instead of renting a CDN, ship Open Connect appliances — storage-dense caches — into ISP data centers and peering points. During off-peak hours they pre-fill with what tomorrow's viewers will likely watch (popularity is predictable for a curated catalog). At prime time, most streams never leave the viewer's own ISP.

Playback becomes a control-plane conversation: GET /api/playback/{id}/manifest returns the ABR ladder, steering to the healthiest nearby appliance, plus DRM license info; the client fetches the license and streams segments locally, adapting bitrate per segment. This is how ~150 Tbps stops being your egress bill — the data plane lives in ISPs.

With distribution solved, retention is the game. GET /api/home is assembled by a personalization service: ML ranks rows, orders titles within rows, and even picks which artwork variant each profile sees. Features come from viewing history — ~200M profiles at ~2 KB is only ~400 GB in a feature store.

The cultural machinery matters as much as the model: everything ships behind A/B experiments, and interviewers love hearing that artwork selection is itself a bandit problem. Continue-watching state syncs via POST /api/profiles/{id}/resume so a pause on the TV resumes on the phone.

Clients report quality-of-experience continuously — startup time, rebuffer events, bitrate achieved — billions of events/day through Kafka into stream processing and the analytics lake. QoE dashboards sliced by ISP, device, and title are how you detect that one appliance, one ISP, or one bad encode is degrading prime time, and they gate the sub-1.5 s playback-start SLO.

The business lane closes the design: billing integrates payment gateways per region, entitlements gate the DRM license service (no valid plan, no license — enforcement happens at key issuance, not in the client), and household/sharing controls plus parental ratings are policy checks on the same entitlement path. Compliance — regional ratings and censorship — filters the catalog per territory just like Spotify's licensing windows.