System Design: Spotify

Tracks sit in object storage, a catalog table maps track → file, and GET /api/stream/{id} proxies audio bytes through your app servers. With a small catalog and few users, done.

Two things break at once. Egress: ~10M concurrent streams at ~256 kbps is on the order of ~2.5 Tbps — through your app tier, that is absurd. Licensing: labels license per region with time windows, so serving any track to anyone is not a bug, it is a contract violation. The catalog needs to be region-aware from day one.

Ingestion becomes a real pipeline: labels deliver masters, the pipeline transcodes to multiple bitrates (Ogg/AAC), writes metadata with licensing windows and territory rights, and pushes assets to object storage and out to CDN caches. The full catalog — ~60M tracks at ~5 MB — is only ~300 TB compressed, tiny by video standards, so the hot set caches beautifully.

Playback splits control from data: POST /api/playback/session checks the user's region against licensing, then issues a short-lived playback token plus CDN URL. The sub-300ms start trick is that the client prefetches the first seconds of likely-next tracks (rest of the album, top of the queue), so most 'starts' are already on the device.

Every play, pause, skip, and like backhauls to POST /api/plays — around ~1B plays/day (~11.5K/sec average, ~50K/sec with interaction events at peak) into a Kafka cluster. These events are simultaneously the analytics source, the royalty-accounting input, and the raw material for recommendations, so losing them is losing money.

Personalization runs on two clocks: batch pipelines compute taste vectors and weekly playlists (Discover Weekly, Release Radar) overnight, while streaming pipelines update session features in near-real-time. Both feed a feature store — ~400M users at ~1 KB per vector is only ~400 GB in Redis/Scylla — that the recommendation API reads at request time.

Offline is not 'save the MP3.' POST /api/offline/request schedules an encrypted package; tracks land on the device encrypted, and a license service issues time-limited decryption keys tied to an active subscription. The client re-validates when connectivity returns — lapse the subscription and the keys stop renewing, so the cached bytes become inert.

The interviewer follow-up is sync conflicts: playlists edited on a phone in airplane mode and on a laptop simultaneously. Per-item operations with last-writer-wins timestamps (or a simple op-log merge) handle it — say the strategy out loud rather than hand-waving 'it syncs.'

Operationally you watch per-region playback start latency (the product metric), CDN hit rates, and Kafka consumer lag — because a lagging pipeline silently degrades tomorrow's recommendations. License audit logs answer the label question 'prove this track never streamed outside its window,' which is a compliance requirement, not nice-to-have.

The same event stream powers artist dashboards: near-real-time stream counts and payout reporting. Ending here shows you see the two-sided marketplace — listeners get sub-300ms magic and Discover Weekly; artists and labels get trustworthy numbers, which is what keeps the catalog licensed at all.