Every kind of component

Mobile app

Flaky networks, battery limits and push notifications. Cache and queue work locally, and design the API so a retry is safe.

e.g. iOS and Android apps for Uber, WhatsApp, Instagram

Web browser

Nothing to install, and the newest version ships to everyone at once. Limited by what the browser allows, and by the user's connection.

e.g. Gmail, Figma, Netflix on the web

Desktop app

Runs a long-lived sync or editing session, often with a local database and offline work.

e.g. Dropbox, Slack and Spotify desktop apps

Smart TV or set-top box

A large screen and a slow remote. Updates ship rarely, so servers must support old app versions for years. Adaptive bitrate streaming is the norm.

e.g. Netflix and YouTube on TVs and streaming sticks

Wearable

Tiny screen and battery. Usually a thin view over the phone or a few small API calls.

e.g. Apple Watch, Fitbit

IoT sensor or device

Constrained, often offline, sending small messages with MQTT or CoAP. Needs device identity, over-the-air updates and backpressure.

e.g. Smart meters, thermostats, trackers

Game console or game client

Latency matters more than throughput. Uses UDP-style protocols and authoritative servers.

e.g. Online games, matchmaking clients

Voice assistant or smart speaker

Audio goes up, a spoken answer comes back, and the speech models run in the cloud.

e.g. Alexa, Google Assistant

Car or in-vehicle system

Lost connectivity is routine, so it needs map caching and delayed uploads. Safety rules limit what you can change.

e.g. Navigation, telematics

Point-of-sale terminal

Must take a payment when the network is down, then reconcile later. Strong rules about card data.

e.g. Card readers, shop tills

Another service (server to server)

A partner or internal system calling your API. Needs API keys or mTLS, quotas and a stable contract.

e.g. Webhooks, B2B APIs

Crawler or bot

Not a person. Rate-limit it, identify it, and keep it away from expensive paths.

e.g. Search engine crawlers, scrapers

Pull CDN

Fetches from your origin the first time a file is asked for, then keeps it. Easy to adopt.

e.g. CloudFront, Cloudflare, Fastly

Push CDN

You upload content ahead of time to every location. Good for big files with predictable demand.

e.g. Pre-positioned video libraries

ISP-embedded caches

Boxes placed inside the networks of internet providers, so video never crosses the wider internet.

e.g. Netflix Open Connect, Google Global Cache

Multi-CDN

Use several CDNs and steer between them for resilience and price.

e.g. Large streaming and e-commerce sites

Edge compute

Runs code at the edge, not only files: redirects, A/B tests, auth checks.

e.g. Cloudflare Workers, Lambda@Edge

Peer-to-peer assisted

Viewers help serve each other. Saves bandwidth, but is harder to control.

e.g. Some live-video and game-update systems

What to cache

Static files, video segments and images cache for a long time. API responses need short lifetimes or careful keys.

e.g. Cache-Control headers

Layer 4 (TCP or UDP)

Forwards connections without reading them. Very fast and simple, with no routing by URL.

e.g. AWS NLB, IPVS

Layer 7 (HTTP)

Reads the request, so it can route by path or header, retry and terminate TLS.

e.g. Nginx, Envoy, AWS ALB

DNS or GeoDNS

Answers with different addresses by region or health. Coarse, because answers are cached.

e.g. Route 53 latency routing

Anycast

The same address is announced from many places and the network sends users to the nearest.

e.g. Cloudflare, public DNS resolvers

Client-side balancing

The caller picks a healthy server from a list. No extra hop, and the logic lives in every client.

e.g. gRPC, service discovery with Consul

Global server load balancing

Chooses between whole regions, including failing over when one goes down.

e.g. Multi-region active-active setups

Algorithms

Round robin is simple, least connections adapts to slow servers, consistent hashing keeps a key on one server.

e.g. Used inside all of the above

Edge gateway

Authentication, rate limits, routing and request shaping for every public call.

e.g. Netflix Zuul, Kong, AWS API Gateway

Backend for frontend (BFF)

A gateway per kind of client, which shapes data for a phone differently from a TV.

e.g. Mobile and web having separate backends

GraphQL gateway

Clients ask for exactly the fields they want and the gateway fans out to services.

e.g. Apollo Federation

Service mesh ingress

Entry to a mesh of internal services, with mutual TLS and traffic rules.

e.g. Istio or Envoy gateways

Rate limiter

Caps requests per user, key or IP with a token bucket or sliding window. Often lives in the gateway.

e.g. API quotas, abuse protection

Public or partner API gateway

Adds keys, plans, usage metering and versioning for outside developers.

e.g. Developer platforms

Session cookie

The server remembers you and the browser sends a cookie. Easy to revoke, needs shared session storage.

e.g. Classic web apps

Token (JWT)

A signed token the service can check without a lookup. Scales well, but is hard to revoke before it expires.

e.g. APIs and mobile apps

OAuth 2 and OpenID Connect

Let users sign in through another provider, or give an app limited access to their data.

e.g. Sign in with Google, GitHub

Single sign-on (SAML)

One company login for many apps.

e.g. Enterprise software

API keys

A secret per developer or app. Simple, so always combine with limits and rotation.

e.g. Public APIs

Mutual TLS

Both sides prove who they are with certificates. The usual way for services to trust each other.

e.g. Service meshes

Passkeys and multi-factor

Phishing-resistant login and a second proof of identity.

e.g. WebAuthn, authenticator apps

Stateless app server

Keeps no session in memory, so any copy can take any request and you scale by adding copies.

e.g. Django or Rails behind a load balancer

Static file server

Serves files from disk or memory with almost no logic. Usually sits behind a CDN.

e.g. Nginx serving a front-end build

Reverse proxy

Terminates TLS, compresses and routes to the real servers.

e.g. Nginx, HAProxy, Envoy

WebSocket or long-connection server

Holds many open connections. Memory and file descriptors become the limit, not CPU.

e.g. Chat gateways, live dashboards

Server-side rendering server

Builds HTML on the server for speed and search. Usually cached heavily.

e.g. Next.js, Rails views

Serverless function

Runs on demand and scales to zero. Pay per call, but cold starts and time limits apply.

e.g. AWS Lambda, Cloud Functions

Edge worker

Runs your code in the CDN's locations, close to the user, for light personalisation and routing.

e.g. Cloudflare Workers

Monolith

One deployable. Simple to build, test and run, and often the right start.

e.g. Early Instagram, Slack's PHP app

Modular monolith

One deployable with strict internal boundaries, so it can be split later.

e.g. Shopify's core

Microservice

Owned by one team, deployed alone, with its own data. Buys independence and costs network calls and operations.

e.g. Netflix, Uber, Spotify

Queue worker or consumer

Takes jobs from a queue and does the slow work off the request path.

e.g. Image resizing, email sending

Stream processor

Reads an event stream continuously and keeps running totals or derived views.

e.g. Flink or Kafka Streams jobs

Batch job

Runs on a schedule over a lot of data, for reports, training and clean-up.

e.g. Nightly billing, model training

Scheduled task or cron

Time-driven work such as expiring records or sending reminders. Make it safe to run twice.

e.g. Digest emails

Sidecar or agent

A helper process next to a service that handles networking, logging or security.

e.g. Envoy in a service mesh

Container orchestrator

Schedules containers, restarts failures and rolls out new versions.

e.g. Kubernetes, Nomad, Titus

Autoscaling

Add and remove copies as load changes.

e.g. Horizontal pod autoscaler

Service mesh

Handles retries, encryption and routing between services.

e.g. Istio, Linkerd

Stateful workloads

Databases and queues that need stable disks and identity.

e.g. StatefulSets, operators

Batch and job scheduling

Run big jobs by priority across a shared fleet.

e.g. Training jobs, Borg-style schedulers

Multi-cluster and multi-region

Spread over clusters for failure isolation and latency.

e.g. Federation, GitOps

Serverless on top

Scale to zero for event-driven code.

e.g. Knative, Cloud Run

Metrics

Numbers over time: request rate, errors and latency.

e.g. Prometheus, Netflix Atlas

Logs

A record of what happened, searchable when you need the detail.

e.g. ELK, Loki

Distributed tracing

Follow one request across every service it touched.

e.g. Jaeger, OpenTelemetry

Alerting and on-call

Page a person when users are hurt, not on every blip.

e.g. Alertmanager, PagerDuty

Synthetic checks

A robot uses the product constantly, so you learn before users do.

e.g. Ping and journey tests

Real user monitoring

Measure what real devices experience.

e.g. Browser and app timing

Chaos and fault injection

Break things on purpose to prove the system copes.

e.g. Chaos Monkey

Service level objectives

State how good is good enough and track the error budget.

e.g. 99.9% of requests under 300 ms

Browser or app cache

Data kept on the device. Free and instant, but you cannot reach in to clear it.

e.g. HTTP caching, local storage

CDN cache

Copies at the edge for files and some responses.

e.g. Images, video segments

In-process cache

A map inside the application. Fastest of all, but every copy holds its own version.

e.g. Caffeine, Guava

Distributed cache

A shared cluster that every app server uses.

e.g. Memcached, Redis, EVCache

Cache-aside

The app checks the cache, then the database, then fills the cache. The most common pattern.

e.g. Most web apps

Write-through or write-behind

Writes go through the cache. Write-behind is faster but can lose data if the cache dies.

e.g. Counters, buffered writes

Precomputed or materialised view

Compute the answer ahead of time and store it, which turns a slow read into a lookup.

e.g. Timelines, leaderboards, recommendation lists

Eviction and expiry

LRU, LFU and TTLs decide what to throw out. Invalidate on write when freshness matters.

e.g. See the Caching simulation

Cache

Key to value with a time-to-live. Takes load off the database.

e.g. Page and object caches

Session store

Shared login state for stateless app servers.

e.g. Web sessions

Leaderboards and counters

Sorted sets and atomic increments make ranking and counting cheap.

e.g. Game scores, view counts

Rate limiting

Atomic counters with expiry are a natural token or window counter.

e.g. API quotas

Pub/sub and streams

Fan messages out to many listeners, or keep a short log to replay.

e.g. Live updates, light queues

Distributed locks

Let one worker at a time do a job. Subtle, so use fencing tokens for anything important.

e.g. Cron deduplication

Geospatial index

Store points and ask for what is within a radius.

e.g. Nearby drivers or shops

Persistence

Snapshots and an append-only log let it survive a restart, but it is not a replacement for a main database.

e.g. RDB and AOF

Relational (SQL)

Tables, joins, transactions and constraints. The default for most data that matters.

e.g. MySQL, PostgreSQL

Wide-column

Huge write volume and linear scaling, with queries designed up front around the key.

e.g. Cassandra, ScyllaDB, Bigtable, HBase

Key-value

Get and put by key at very high speed and scale. Few query options.

e.g. DynamoDB, Riak

Document

Flexible JSON-like records that you usually read whole.

e.g. MongoDB, Firestore

Graph

Follow relationships many hops deep, such as friends of friends.

e.g. Neo4j, Amazon Neptune

Time series

Measurements over time, with fast writes and rollups.

e.g. InfluxDB, Prometheus, TimescaleDB

NewSQL or distributed SQL

SQL and transactions across many machines and regions.

e.g. Spanner, CockroachDB

Data warehouse (analytics)

Columnar storage for big scans and reports, not for serving users.

e.g. BigQuery, Snowflake, Redshift

Ledger

An append-only, verifiable history of changes.

e.g. Payments and audit systems

Vector database

Find the nearest items by meaning, for search and retrieval for AI.

e.g. pgvector, Pinecone, Milvus

Sharding and replication

Split data across machines for size, copy it for safety and read capacity.

e.g. See the Sharding and Replication simulations

Primary for transactions

The one source of truth for orders, accounts and anything that needs correct totals.

e.g. Payments, bookings

Read replicas

Copies that serve reads. Lag means they can be slightly behind.

e.g. Reporting and read-heavy pages

Sharded relational

Split by a key across many servers, with a layer that routes queries.

e.g. Vitess for MySQL, Citus for Postgres

JSON columns

Keep flexible fields next to structured ones.

e.g. JSONB

Geospatial

Points, areas and distance queries inside the database.

e.g. PostGIS

Vector search

Store embeddings next to the rows they describe.

e.g. pgvector

Change data capture

Stream committed changes out to other systems.

e.g. Logical replication

Connection pooling

A database handles few connections well, so pool them in front.

e.g. PgBouncer

Flexible schema

Different records can carry different fields, so the model can evolve.

e.g. Product catalogues

Content management

Articles and pages as documents.

e.g. Publishing sites

Embedded versus referenced data

Embed what is always read together, reference what grows without limit.

e.g. Design decision in every model

Sharded cluster

Split by a shard key. The key decides whether load spreads or piles up.

e.g. Large collections

Change streams

Subscribe to changes as they happen.

e.g. Cache invalidation, sync

When not to use it

Many joins and strict multi-record transactions favour a relational database.

e.g. Billing, inventory

Full-text search

Ranked results for words, with typo tolerance and filters.

e.g. Site and product search

Autocomplete

Prefix and fuzzy matching on every keystroke.

e.g. Search boxes

Log and event analytics

Search and aggregate huge volumes of logs.

e.g. The ELK stack

Geo search

Find things near a point or inside an area.

e.g. Maps, delivery

Semantic search

Match by meaning with embeddings next to keywords.

e.g. Hybrid retrieval

Faceting and aggregation

Counts by category, price range or date next to the results.

e.g. Shop filters

Keeping it in step

The index is a copy: feed it from the main database through events and be ready to rebuild it.

e.g. Change data capture

Blob store for media

Images, video and documents, with a CDN in front.

e.g. Amazon S3, Google Cloud Storage

Data lake

Raw files of every kind kept for analytics.

e.g. S3 with Parquet

Backup and archive tiers

Very cheap and slow storage for data you rarely read.

e.g. S3 Glacier

Block and file storage

Disks and shared file systems for databases and apps that need them.

e.g. EBS, NFS

Content-addressed storage

Name data by its hash, which gives free deduplication.

e.g. Dropbox blocks, Git

Erasure coding

Survive lost disks with far less overhead than full copies.

e.g. Magic Pocket, S3

Upload patterns

Send big files straight to storage with a signed URL, in resumable parts, and keep only a reference in the database.

e.g. Presigned uploads

Event backbone

Services publish facts, others react. Decouples teams and absorbs spikes.

e.g. Uber, LinkedIn, Netflix

Change data capture

Turn database changes into events, to keep caches, search and warehouses in step.

e.g. Debezium

Stream processing input

The source for jobs that count, join and window events as they arrive.

e.g. Flink, Kafka Streams

Log and metrics pipeline

Carry logs and metrics from thousands of machines to storage and dashboards.

e.g. Observability pipelines

Event sourcing

Store every change as an event and rebuild state by replaying them.

e.g. Ledgers, audit trails

Ordering and partitions

Order holds only within a partition, so choose the key carefully. Consumers share partitions in a group.

e.g. See the Event-driven simulation

Managed alternatives

The same idea as a service, with less to run.

e.g. Kinesis, Pub/Sub, Pulsar, Redpanda

Work queue

Each job is handled by one worker. Scale by adding workers.

e.g. Thumbnailing, sending email

Publish and subscribe

Every subscriber gets a copy of each message.

e.g. Notifications to several systems

Delay and retry queue

Try again later with growing waits instead of hammering a failing system.

e.g. Payment retries

Dead-letter queue

Set aside messages that keep failing so one bad message cannot block the line.

e.g. Poison messages

Request and reply

Send a job and wait for an answer on a reply queue.

e.g. RPC over a broker

Managed queues

Hosted queues and topics with little to operate.

e.g. SQS and SNS, Cloud Tasks

Delivery guarantees

At-least-once delivery means handlers must be idempotent. Exactly-once is mostly a combination of that and deduplication.

e.g. Idempotency keys

Authoritative DNS

Holds the real records for your domain and answers for them.

e.g. Route 53, Cloudflare DNS

Recursive resolver

Looks names up on the user's behalf and caches the answers.

e.g. ISP resolvers, 1.1.1.1, 8.8.8.8

GeoDNS or latency routing

Gives different answers by where the user is, to send them to the nearest region.

e.g. Multi-region sites

Health-checked failover

Stops giving out the address of a region that is down.

e.g. Disaster recovery

Weighted records

Split traffic by percentage, for gradual rollouts.

e.g. Canary releases

TTL

How long answers are cached. Short means faster failover and more lookups, long means fewer lookups and slower change.

e.g. 60 seconds to a day

Web application firewall

Reads HTTP requests and blocks attacks such as SQL injection and cross-site scripting.

e.g. Cloudflare WAF, AWS WAF

DDoS protection

Absorbs floods of traffic at the edge, where there is enough capacity to take it.

e.g. Cloudflare, AWS Shield

Network firewall and security groups

Allow only the ports and addresses a part really needs.

e.g. VPC security groups

Bot management

Tells people from scripts using behaviour and challenges.

e.g. Captcha, device signals

Zero trust

No part is trusted because of where it is: every request proves who it is.

e.g. BeyondCorp, mTLS

Token bucket

Tokens refill at a steady rate and each request spends one. Allows short bursts.

e.g. API gateways, Stripe

Fixed window counter

Count requests in each minute. Simple, but allows a double burst across a boundary.

e.g. Basic quotas

Sliding window

Count over the last N seconds, smoothing the boundary problem at more cost.

e.g. Login attempts

Leaky bucket

Requests drain at a fixed rate, which smooths traffic going to a fragile service.

e.g. Outbound calls

Per key, per user, per IP

Choose who is being limited. IP alone punishes shared networks.

e.g. Public APIs

Where to enforce it

At the edge and gateway for outsiders, and inside for services calling each other. Return 429 with a retry hint.

e.g. Redis counters

WebSocket

Two-way messages over one connection. The usual choice for chat and live apps.

e.g. Slack, Discord

Server-sent events

One-way stream from server to browser. Simpler, and works well through proxies.

e.g. Live scores, notifications

Long polling

The client asks and the server answers when it has something. A fallback when nothing else works.

e.g. Older chat systems

MQTT

A light publish and subscribe protocol for small devices on poor networks.

e.g. IoT platforms

gRPC streaming

Typed streams between services or to apps.

e.g. Internal real-time feeds

Scaling it

Each connection costs memory, so you count connections per machine. Route a user back to their server, or look up where they are.

e.g. Presence and routing tables

Function as a service

A function per event, billed per call and by time. Scales to zero.

e.g. AWS Lambda, Cloud Functions

Edge functions

Run in the CDN's locations for very low latency.

e.g. Cloudflare Workers

Container-based serverless

Run any container on demand, with scale to zero.

e.g. Cloud Run, Fargate

Event triggers

A queue message, a file upload or a schedule starts the function.

e.g. S3 upload then resize

Limits to plan for

Cold starts, time limits, no long-lived connections and no local state.

e.g. Think stateless and short

Single-job worker

Takes one job, does it, acknowledges it. Scale by adding workers.

e.g. Sending email, thumbnails

Batch worker

Takes many jobs at once for efficiency.

e.g. Bulk writes to a warehouse

Priority workers

Separate pools for urgent and background queues so one cannot starve the other.

e.g. Payments before reports

Retry with backoff

Try again after growing waits, then give up to a dead-letter queue.

e.g. Flaky downstream calls

Idempotent handlers

Safe to run twice, because delivery is at least once.

e.g. Idempotency keys

Autoscaling on queue depth

Add workers when the line grows and remove them when it empties.

e.g. KEDA, SQS metrics

Cron

Run a command at set times. Simple, but one machine is a single point of failure.

e.g. Nightly reports

Managed scheduler

A service fires jobs on a schedule and retries them.

e.g. Cloud Scheduler, EventBridge

Workflow engine

Chains of steps with dependencies, retries and a history.

e.g. Airflow, Temporal, Step Functions

Delayed jobs

Run this once, in a day. Reminders, expiries, trial endings.

e.g. Delay queues

Leader election

When several copies could run the job, make sure only one does.

e.g. Locks, etcd leases

Safe to run twice

A job can be retried or overlap, so design it to be idempotent.

e.g. Upserts, checkpoints

Windowed aggregation

Count or sum over the last minute, hour or session.

e.g. Clicks per minute

Stream joins

Combine two streams, or a stream with a table, as events arrive.

e.g. Orders with customers

Stateful processing

Keep running state, checkpointed so it survives a crash.

e.g. Flink, Kafka Streams

Event-time and late data

Handle events that arrive out of order, using watermarks.

e.g. Mobile events

Exactly-once effects

Transactional writes and checkpoints so results are not counted twice.

e.g. Billing streams

Stream versus batch

Streams give answers in seconds, batch is simpler and cheaper for big reprocessing.

e.g. Lambda and kappa designs

Online inference

A request in, a prediction out, in milliseconds.

e.g. Ranking, fraud scoring

Batch inference

Score a large set ahead of time and store the results.

e.g. Nightly recommendations

Feature store

A shared store of inputs, so training and serving see the same values.

e.g. Feast, Tecton

Model registry and versions

Roll models out gradually, compare them and roll back.

e.g. A/B tests, shadow mode

GPU or CPU serving

Big models need accelerators, small ones run cheaply on CPUs.

e.g. Batching to keep GPUs busy

Monitoring for drift

Watch inputs and quality, because the world changes under a model.

e.g. Data drift alerts

Hosted model API

Call a provider and pay per token. Fastest to start.

e.g. Claude, GPT, Gemini

Self-hosted model

Run open weights on your own GPUs for control and privacy, with the work of operating them.

e.g. vLLM, TGI

Retrieval-augmented generation

Fetch relevant documents first and put them in the prompt, so answers are grounded in your data.

e.g. Vector search plus an LLM

Tool use and agents

The model calls your APIs and sees the results, in a loop.

e.g. Function calling

Streaming responses

Send tokens as they are produced so the user is not staring at a spinner.

e.g. Server-sent events

Caching and routing

Cache repeated prompts, and send easy questions to small models.

e.g. Prompt caching, model routers

Guardrails and evaluation

Filter inputs and outputs, and measure quality on a fixed test set.

e.g. Safety checks, eval suites

Key-value

Get and put by key. The simplest model, and very fast.

e.g. DynamoDB, Riak, Redis

Wide-column

Rows with many columns, partitioned by a key and sorted within it.

e.g. Cassandra, ScyllaDB, Bigtable

Document

Nested JSON-like records.

e.g. MongoDB, Couchbase

Partition key design

The key decides how data and load spread. A hot key defeats the whole design.

e.g. Add a salt or bucket

Tunable consistency

Choose per request how many replicas must agree.

e.g. Cassandra quorums

Single-table design

Model the access patterns first, then lay the data out for them.

e.g. DynamoDB

Asynchronous replica

Fast writes, but the copy lags, so a read can be stale.

e.g. MySQL, PostgreSQL streaming

Synchronous replica

A write waits for the copy, so nothing is lost, at the cost of speed.

e.g. Critical ledgers

Semi-synchronous

Wait for one copy of several, a middle path.

e.g. MySQL semi-sync

Cross-region replica

A copy near distant users, and a way to recover from losing a region.

e.g. Global read scaling

Failover target

Promote a replica when the primary fails. Promote the most up to date one.

e.g. Automated failover

Read your own writes

After a user writes, read from the primary for a short while so they see it.

e.g. Session pinning

Columnar warehouse

Scans a few columns of billions of rows quickly.

e.g. BigQuery, Snowflake, Redshift

Data lake

Raw files in cheap storage, queried in place.

e.g. S3 and Parquet, Delta, Iceberg

ETL and ELT

Move data in on a schedule or a stream, transforming it before or after.

e.g. dbt, Airflow

OLAP cubes and real-time analytics

Pre-aggregated answers in milliseconds for dashboards.

e.g. Druid, Pinot, ClickHouse

Change data capture in

Stream changes from the main database so the warehouse stays current.

e.g. Debezium

Governance

Who can see what, where data came from, and how long it is kept.

e.g. Catalogs, lineage

Metrics store

Counters and gauges from machines and services.

e.g. Prometheus, Atlas

IoT and sensor data

Millions of devices reporting every few seconds.

e.g. InfluxDB, TimescaleDB

Downsampling and retention

Keep recent data in full detail and older data as averages, then expire it.

e.g. Rollups

Compression

Timestamps and values compress very well, so storage stays small.

e.g. Delta encoding

Cardinality

Too many distinct label combinations is what hurts, not the number of points.

e.g. Avoid user IDs as labels

Property graph

Nodes and relationships that both carry properties, queried by following links.

e.g. Neo4j

Social and friend graphs

Who knows whom, and friends of friends, in a few hops.

e.g. LinkedIn, Facebook TAO

Fraud and recommendation

Find rings and patterns by walking the graph.

e.g. Payments, shopping

Knowledge graph

Facts as links between entities, used for search and answers.

e.g. Wikidata, Google

Graph on top of a relational store

Many large systems keep edges in sharded SQL or key-value stores, and cache them hard.

e.g. TAO, Pinterest

When not to use one

If your queries are mostly lookups by key, a graph adds cost without benefit.

e.g. Prefer SQL or key-value

Approximate nearest neighbour

Trade a little accuracy for very fast search over millions of vectors.

e.g. HNSW, IVF indexes

Dedicated vector database

Built for this one job, with filters and scale.

e.g. Pinecone, Milvus, Qdrant

Vectors inside your database

Keep embeddings next to the rows they describe.

e.g. pgvector

Hybrid search

Combine keyword matching with meaning for better results.

e.g. BM25 plus vectors

Retrieval for LLMs

Fetch the best passages to put in a prompt.

e.g. RAG systems

Keeping it fresh

Re-embed when content or the model changes, and watch the cost.

e.g. Backfill jobs

Topic with subscriptions

Each subscriber has its own queue of the messages.

e.g. SNS to SQS, Google Pub/Sub

Fan-out

One event starts many independent actions.

e.g. Order placed: email, stock, analytics

Filtering

Subscribers only receive the messages that match.

e.g. Topic and attribute filters

Ordering and replay

Some systems keep order per key and let you replay history.

e.g. Kafka-like logs

Push or pull delivery

The broker calls you, or you ask it. Pull gives you control of the rate.

e.g. Webhooks versus consumers

Delivery guarantees

At least once, so handlers must be safe to repeat.

e.g. Idempotency

Push notifications

Through Apple and Google's services to a phone.

e.g. APNs, FCM

Email

Cheap and universal, but needs authentication, reputation and unsubscribe handling.

e.g. SES, SendGrid

SMS and WhatsApp

High reach and high cost, used for codes and urgent messages.

e.g. Twilio

In-app and web push

Messages inside the product or the browser.

e.g. Notification centres

Preferences and quiet hours

Let people choose what and when. Batch and de-duplicate.

e.g. Digest emails

Delivery tracking

Know what was sent, delivered, opened and bounced.

e.g. Webhooks, suppression lists

DNS-based

Names resolve to the current instances. Simple, but cached.

e.g. Kubernetes services

Registry

Instances register and send heartbeats, and callers look them up.

e.g. Consul, Eureka

Consensus store

A small, strongly consistent store for configuration and locks.

e.g. etcd, ZooKeeper

Client-side or sidecar

The caller or a sidecar keeps the list and balances itself.

e.g. Envoy, gRPC

Leader election

Agree on which copy is in charge.

e.g. Raft, lease locks

Health checks

Remove instances that are not answering.

e.g. Liveness and readiness probes

Secrets manager

Encrypted storage with access control, audit and rotation.

e.g. Vault, AWS Secrets Manager

Configuration store

Settings that change without a deploy.

e.g. Parameter Store, Consul KV

Feature flags

Turn a feature on for some users, or off in a hurry.

e.g. LaunchDarkly, Unleash

Key management and envelopes

Encrypt data with keys the cloud holds in hardware.

e.g. KMS, HSM

Short-lived credentials

Issue access that expires in minutes, instead of keys that last for years.

e.g. IAM roles, dynamic secrets

Rotation

Change secrets regularly and after any leak, without downtime.

e.g. Dual-key rollover

Agents and collectors

A small process on each host ships logs onward.

e.g. Fluent Bit, Vector

Log search

Index logs so you can query by field and time.

e.g. Elasticsearch, Loki, Splunk

Structured logs

JSON with fields beats free text for searching and alerting.

e.g. Request ID, user ID

Buffering

A queue between agents and storage absorbs bursts.

e.g. Kafka in front of the index

Retention and cost

Keep recent logs hot, older ones cheap, and sample the noisy ones.

e.g. Tiered storage

Privacy

Never log secrets or personal data you do not need.

e.g. Redaction

Card payment gateway

Collects the card in the provider's fields and returns a token.

e.g. Stripe, Razorpay, Adyen

Wallets and bank transfers

Local methods people prefer in each country.

e.g. UPI, Apple Pay, SEPA

Idempotent requests

A retry must never charge twice.

e.g. Idempotency keys

Webhooks for the outcome

The final result often arrives later, by callback. Handle repeats.

e.g. payment.succeeded

Reconciliation

Compare your records with the provider's every day.

e.g. Settlement reports

Compliance

Staying out of card data keeps most of the scope away from you.

e.g. PCI DSS

Maps, identity, email and SMS

The usual rented capabilities.

e.g. Google Maps, Auth0, Twilio

Timeouts and retries

Never wait for ever, and back off when retrying.

e.g. Circuit breakers

Fallbacks

Decide what the product does when the call fails.

e.g. Cached results, a simpler path

Quotas and cost

Limits and per-call prices shape the design.

e.g. Cache expensive calls

Anti-corruption layer

Wrap the provider so you can change it without touching the rest.

e.g. An adapter service

Webhooks in

They call you, so verify signatures and expect repeats.

e.g. Signed callbacks

TLS termination

Handle HTTPS once at the edge so the servers behind it speak plain, fast HTTP.

e.g. Nginx, Envoy, HAProxy

Caching proxy

Keep copies of responses and answer repeat requests without bothering the app.

e.g. Varnish, Nginx cache

Compression and static files

Gzip or Brotli responses and serve images and scripts straight from disk.

e.g. Nginx

Routing by path or host

Send /api to one service and /app to another.

e.g. Ingress controllers

Connection buffering

Absorb slow clients so app servers are not held up waiting for them.

e.g. Nginx in front of Rails or Django

Forward proxy (the opposite)

Stands in front of clients, not servers, to filter or hide where they go.

e.g. Corporate proxies

Sidecar proxy

A small proxy next to each service handles retries, timeouts and encryption.

e.g. Envoy with Istio or Linkerd

Mutual TLS

Every call is encrypted and each side proves who it is, with no code changes.

e.g. Zero trust inside the cluster

Traffic shifting

Send 5% of calls to a new version, then more, and roll back instantly.

e.g. Canary releases

Observability for free

Metrics and traces for every call, without instrumenting each service.

e.g. Golden signals per route

Sidecarless meshes

Do the same work in the node or the kernel, with less overhead.

e.g. Ambient mesh, eBPF

What it costs

More moving parts, extra latency, and another thing to operate. Worth it with many services.

e.g. Skip it for a handful

VPC and subnets

Your own private address space, split into public and private parts.

e.g. AWS VPC, Google VPC

Public and private subnets

Only load balancers face the internet. Databases and servers stay private.

e.g. The usual three-tier layout

Security groups and network rules

Allow only the ports a part really needs, from the parts that need them.

e.g. Least privilege

NAT and egress control

Let private machines call out without being reachable from outside.

e.g. NAT gateways

VPN and private links

Join your office or another cloud to this network safely.

e.g. Site-to-site VPN, PrivateLink

Multiple accounts and regions

Separate production from testing, and spread across regions for failure isolation.

e.g. Peering, transit gateways

Single sign-on

One login, many apps, and one place to switch someone off.

e.g. Okta, Azure AD

OpenID Connect and OAuth 2

Modern protocols for signing in and for handing out limited access.

e.g. Sign in with Google

SAML

The older enterprise standard, still everywhere in big companies.

e.g. Workforce logins

Customer identity

Sign-up, social login, passwords, passkeys and multi-factor for your own users.

e.g. Auth0, Cognito, Firebase Auth

Directory and groups

People, teams and roles that other systems read to decide access.

e.g. LDAP, SCIM provisioning

Self-hosted

Run it yourself for control and cost.

e.g. Keycloak, Authentik

Docker image and container

The image is the package, the container is a running copy of it.

e.g. Docker, containerd

Managed container service

Run containers without running the cluster.

e.g. ECS, Fargate, Cloud Run

Orchestrated by Kubernetes

A cluster decides where containers run and replaces failed ones.

e.g. See Kubernetes

Sidecars

A helper container next to the main one for logging, proxying or secrets.

e.g. Envoy, Fluent Bit

Stateless by design

Keep data outside the container, because it can vanish at any time.

e.g. Volumes, databases

Image hygiene

Small, scanned, pinned images start faster and are safer.

e.g. Distroless bases

On-demand instances

Pay by the second, start and stop at will.

e.g. EC2, Compute Engine

Reserved and committed

A discount for promising to use it for a year or more.

e.g. Savings plans

Spot or preemptible

Much cheaper, but the cloud can take it back. Good for batch and stateless work.

e.g. Spot instances

Auto scaling groups

Add and remove machines as load changes, behind a load balancer.

e.g. ASGs, managed instance groups

Images and configuration

Build a machine image so every new machine starts identical.

e.g. AMIs, Packer, Ansible

Pets versus cattle

Treat machines as replaceable, so losing one is routine.

e.g. Immutable infrastructure

MapReduce

Split the work, process pieces in parallel, then combine the results.

e.g. Hadoop

Spark

In-memory processing that is far faster than disk-based MapReduce for many jobs.

e.g. Apache Spark, Databricks

SQL on big data

Query huge files with ordinary SQL.

e.g. Presto, Trino, Hive

Batch ETL

Move and reshape data on a schedule into a warehouse.

e.g. Nightly pipelines

Shuffles and skew

Moving data between machines is the expensive step, and one hot key can slow the whole job.

e.g. Salting keys

Serverless data processing

Pay per query instead of keeping a cluster.

e.g. BigQuery, Athena

DAG schedulers

Jobs with dependencies, run on a timetable.

e.g. Airflow, Dagster

Durable execution

Code that keeps running through crashes and restarts, with its state saved.

e.g. Temporal, Cadence

State machines

Draw the steps and the rules for moving between them.

e.g. AWS Step Functions

Sagas

A chain of local transactions, each with a compensation if a later one fails.

e.g. Order and payment flows

Retries, timeouts and signals

Handle slow steps, wait for a human or an outside event, and carry on.

e.g. Approvals

Visibility

See where each run is, and why it stopped.

e.g. Run history, audit

Continuous integration

Build and test every change automatically.

e.g. GitHub Actions, GitLab CI

Continuous delivery

Every passing change can be released at the push of a button.

e.g. Pipelines with approvals

Blue-green deploys

Run old and new side by side and switch traffic over at once.

e.g. Fast rollback

Canary releases

Send a small share of traffic to the new version first.

e.g. Progressive delivery

Infrastructure as code

Define servers and networks in files that are reviewed like code.

e.g. Terraform, Pulumi

GitOps

The repository is the source of truth, and the cluster follows it.

e.g. Argo CD, Flux

Business intelligence

Self-service charts over the warehouse for analysts and managers.

e.g. Looker, Metabase, Tableau

Operational dashboards

Live graphs of system health for engineers.

e.g. Grafana

Embedded analytics

Charts inside your own product for your customers.

e.g. Per-tenant dashboards

Pre-aggregation

Compute the numbers ahead of time so charts load instantly.

e.g. Rollup tables, OLAP

Scheduled reports

Email the numbers every Monday.

e.g. PDF and CSV exports

Access control

Each person sees only the rows they are allowed to.

e.g. Row-level security

Offline store

Large history for training, in a warehouse or lake.

e.g. Parquet, BigQuery

Online store

The latest values, served in milliseconds.

e.g. Redis, DynamoDB

Point-in-time correctness

Training must only see what was known at the time, never the future.

e.g. Avoid leakage

Streaming features

Counts and averages kept fresh from an event stream.

e.g. Clicks in the last hour

Sharing across teams

Define a feature once and reuse it in many models.

e.g. Feast, Tecton

Batch training

Retrain on a schedule over a fixed dataset.

e.g. Nightly or weekly jobs

Online and incremental learning

Update the model as new data arrives.

e.g. Recommendation systems

Distributed training

Split data or the model across many GPUs.

e.g. Data and model parallelism

Experiment tracking

Record settings, data and results so a run can be repeated.

e.g. MLflow, Weights and Biases

Evaluation and gating

Only promote a model that beats the current one on fixed tests.

e.g. Offline metrics, then A/B

Model registry

Versioned models with a history of what shipped where.

e.g. Rollbacks

Video transcoding

Make many resolutions and codecs from one upload.

e.g. FFmpeg, MediaConvert

Adaptive bitrate packaging

Cut video into short segments with a playlist, so players can switch quality.

e.g. HLS, DASH

Chunked parallel encoding

Split the file, encode the pieces on many machines, join them.

e.g. Netflix-style pipelines

Thumbnails and previews

Pick frames and make short clips.

e.g. Sprite sheets

Image resizing

Make sizes and formats on demand or at upload.

e.g. WebP and AVIF variants

Live transcoding

Do it in real time with a few seconds of delay.

e.g. Twitch, live events

Rules engine

Clear rules such as too many attempts or a new country. Easy to explain.

e.g. Velocity checks

Machine-learning scoring

A model learns patterns that rules miss.

e.g. Gradient boosting, neural nets

Graph analysis

Find rings of linked accounts, cards and devices.

e.g. Shared devices and addresses

Device and behaviour signals

How someone types and moves, and what device they use.

e.g. Fingerprinting

Step-up and review

Ask for more proof or send to a person when the score is borderline.

e.g. 3-D Secure, manual queues

Feedback loop

Confirmed fraud and false alarms go back in as training data.

e.g. Chargebacks

Automated classifiers

Models that flag spam, nudity, hate and violence at scale.

e.g. Image and text models

Hash matching

Recognise known bad files from a fingerprint, without viewing them again.

e.g. PhotoDNA

Human review queues

People decide the hard cases, with tools and support.

e.g. Trust and safety teams

Reports and appeals

Users flag content, and can challenge decisions.

e.g. Report buttons

Rate and reputation limits

New or risky accounts get tighter limits.

e.g. Throttles

Pre versus post moderation

Check before it shows, or after. Pre is safer and slower.

e.g. Comments, live video

Primary and replicas

One writer, many readers, with some lag.

e.g. Most web apps

Sharding with Vitess

Split tables across many servers behind a routing layer.

e.g. YouTube, Slack, GitHub

Semi-synchronous replication

Wait for one replica to confirm, to avoid losing acknowledged writes.

e.g. Safer failover

Online schema change

Change big tables without locking them.

e.g. gh-ost, pt-online-schema-change

Used as a key-value store

Facebook's TAO and Uber's Schemaless sit on MySQL.

e.g. Storage layers on MySQL

Managed MySQL

Backups and failover handled for you.

e.g. RDS, Cloud SQL, PlanetScale

Globally consistent

Transactions across continents, with clocks keeping order.

e.g. Google Spanner

Postgres-compatible

Use the Postgres protocol and tools on a distributed engine.

e.g. CockroachDB, YugabyteDB

MySQL-compatible

The same, for MySQL.

e.g. TiDB, Vitess

Consensus replication

Each slice of data is copied by Raft or Paxos, so a majority must agree.

e.g. Automatic failover

Cost of distance

A write that spans regions waits for the speed of light. Keep related data together.

e.g. Geo-partitioning

When you need it

When one machine is too small and eventual consistency is not enough.

e.g. Money, inventory

Double-entry ledger

Every movement of money is two equal entries, so the books always balance.

e.g. Payments, wallets

Append-only log

Corrections are new entries, so history stays intact.

e.g. Event sourcing

Verifiable ledger

A cryptographic chain that shows if anything was changed.

e.g. QLDB, immutable audit logs

Idempotent postings

The same transaction posted twice is recorded once.

e.g. Idempotency keys

Reconciliation

Compare your ledger with the bank's, every day.

e.g. Settlement files

Balances as views

A balance is the sum of entries, cached for speed.

e.g. Snapshots

Network file system

Machines mount the same folders over the network.

e.g. NFS, EFS, Filestore

Distributed file systems

Files split into blocks across many machines for big data work.

e.g. HDFS, GFS, Colossus

Object versus file

Objects are named blobs with no folders to lock. Files give familiar semantics at lower scale.

e.g. S3 versus EFS

Performance tiers

Choose throughput and latency against price.

e.g. Provisioned throughput

Locking and consistency

Many writers need rules. Keep it simple with one writer per file.

e.g. Close-to-open consistency

SSD volumes

Fast disks for databases and anything that needs low latency.

e.g. EBS gp3, io2

Throughput volumes

Cheaper, built for big sequential reads.

e.g. Log processing

Snapshots

Point-in-time copies for backup and cloning, stored cheaply.

e.g. Incremental backups

Local NVMe

The fastest disks, but they vanish with the machine.

e.g. Caches, scratch space

Replicated volumes

Copied across zones so one failure is survivable.

e.g. Multi-attach, cross-zone

Files in object storage

Parquet or ORC files in folders, cheap and huge.

e.g. S3, GCS, ADLS

Table formats

Adds transactions, schema change and time travel to files.

e.g. Iceberg, Delta Lake, Hudi

Lakehouse

Warehouse speed with lake flexibility, in one place.

e.g. Databricks, Snowflake with Iceberg

Zones

Raw, cleaned and curated layers, each more trusted than the last.

e.g. Bronze, silver, gold

Catalog and governance

Know what data exists, who owns it, and who may read it.

e.g. Glue, Unity Catalog

Partitioning

Lay files out by date or key so queries read only what they need.

e.g. Year, month, day

Archive tiers

Pennies per terabyte, with retrieval that takes minutes to hours.

e.g. Glacier, Archive storage

Lifecycle rules

Move data to colder tiers as it ages, and delete it at the end of its life.

e.g. 30, 90, 365 days

Compliance retention

Keep records for years, locked so they cannot be deleted early.

e.g. WORM, object lock

Offline media

Tape and shipped disks for the very largest transfers.

e.g. Snowball

Restore planning

Test getting data back, and know how long it takes and costs.

e.g. Retrieval fees

Log-based CDC

Read the database's own transaction log. Complete and gentle on the database.

e.g. Debezium

Keeping search and caches in step

Push every change to the index and invalidate caches.

e.g. Elasticsearch sync

Feeding the warehouse

Stream changes in so analytics are minutes old, not a day.

e.g. Fivetran, Airbyte

Outbox pattern

Write the event in the same transaction as the data, then publish it.

e.g. No lost events

Initial snapshot

Copy what is there first, then follow the changes.

e.g. Backfill

Ordering and schema change

Keep events in order per key, and handle columns being added.

e.g. Schema registry

Geohash

Cut the map into a grid of cells with a short code each.

e.g. Redis GEO

H3 hexagons

Uniform hexagonal cells at many resolutions.

e.g. Uber

S2 cells

Cells on a sphere, handy for covering regions.

e.g. Google Maps, Tinder

Quadtree

Split busy areas finer than empty ones.

e.g. Dense city centres

PostGIS and R-trees

Spatial indexes inside a database.

e.g. Polygon queries

Moving objects

Keep positions fresh in memory and index by cell.

e.g. Drivers, couriers

Managed event bus

Route events by pattern to the services that asked for them.

e.g. EventBridge, Event Grid

Schema and contracts

Agree what an event looks like and version it carefully.

e.g. Schema registry

Choreography

Each service reacts to events, with no central coordinator.

e.g. Loose coupling

Orchestration instead

A central workflow calls each step. Clearer, but more coupled.

e.g. Sagas

Replay and archive

Keep events so you can rebuild a service or debug.

e.g. Event archives

Dead-letter handling

Set aside events that cannot be processed.

e.g. DLQ

Topics and wildcards

Devices publish to named topics and subscribers match them with patterns.

e.g. home/+/temperature

Quality of service

Fire and forget, at least once, or exactly once, chosen per message.

e.g. QoS 0, 1, 2

Retained messages and last will

New subscribers get the last value, and a device's disappearance is announced.

e.g. Presence

Persistent sessions

Queue messages for a device that is offline.

e.g. Commands to sleeping devices

Clustered brokers

Millions of connections across many brokers.

e.g. EMQX, HiveMQ, AWS IoT

Security

A certificate per device, and rules for which topics it may use.

e.g. mTLS

Signed payloads

Sign each call so the receiver can verify it came from you.

e.g. HMAC signatures

Retries with backoff

Try again after growing delays, for days if needed.

e.g. Exponential backoff

At-least-once delivery

Receivers must handle repeats, so include an event ID.

e.g. Idempotent handlers

Ordering

Do not promise order. Include a version or timestamp.

e.g. Fetch the latest state instead

Failure handling

Disable a dead endpoint after many failures, and tell the owner.

e.g. Delivery dashboards

Replay

Let customers resend events they missed.

e.g. Event logs

Transactional email

Receipts and password resets, sent at once.

e.g. SES, Postmark

Bulk and marketing email

Large sends with lists, templates and scheduling.

e.g. SendGrid, Mailchimp

Authentication records

SPF, DKIM and DMARC prove the mail is really yours.

e.g. DNS records

Reputation and warm-up

Increase volume slowly on a new address.

e.g. IP pools

Bounces and complaints

Stop mailing addresses that bounce or complain.

e.g. Suppression lists

Inbound email

Receive and parse mail sent to you.

e.g. Support tickets, replies

Release toggles

Ship dark, turn on for staff, then for everyone.

e.g. Gradual rollout

Kill switches

Turn something off in seconds when it misbehaves.

e.g. Incident response

Percentage rollouts

Enable for 1%, then 10%, then all, by a stable hash of the user.

e.g. Canary by user

Experiments

Compare two versions and measure the difference.

e.g. A/B tests

Targeting rules

Enable by plan, country or account.

e.g. LaunchDarkly, Unleash

Flag hygiene

Remove old flags, or they become hidden complexity.

e.g. Expiry dates

Spans and trace IDs

Each step is a span, joined by an ID passed along with the request.

e.g. OpenTelemetry

Sampling

Keep a share of traces, plus all the slow and failed ones.

e.g. Tail-based sampling

Trace backends

Store and search traces.

e.g. Jaeger, Tempo, Zipkin

Finding the slow step

The waterfall view shows where the time went.

e.g. Latency debugging

Linking to logs and metrics

Jump from a slow trace to its logs.

e.g. Correlation IDs

Cost

Traces are large, so sample and set retention.

e.g. Short retention

Symptom-based alerts

Page on what users feel, such as errors and slowness, not on every CPU spike.

e.g. SLO burn rate

Routing and escalation

Send to the team that owns it, and escalate if nobody answers.

e.g. PagerDuty, Opsgenie

Runbooks

Each alert links to what to check and do.

e.g. Playbooks

Deduplication and silencing

One incident, one page.

e.g. Alert grouping

Status pages

Tell customers what is happening.

e.g. Incident updates

Post-incident review

Learn from each incident without blame.

e.g. Action items

Cloud KMS

Keys that never leave the service, used by calling an API.

e.g. AWS KMS, Cloud KMS

Hardware security modules

Tamper-resistant devices for the most sensitive keys.

e.g. HSM, CloudHSM

Envelope encryption

Encrypt data with a data key, and encrypt that key with a master key.

e.g. Per-object keys

Rotation

Replace keys on a schedule and after any suspicion.

e.g. Automatic rotation

Customer-managed keys

Let customers hold the key that protects their data.

e.g. BYOK

Access policies and audit

Who may use which key, and a record of every use.

e.g. Key policies

Full and incremental

A whole copy now and then, and small changes between.

e.g. Daily dumps, hourly logs

Point-in-time recovery

Replay the log to any moment, such as just before a bad deploy.

e.g. WAL archiving

Off-site and cross-region

Keep a copy somewhere else, so one failure cannot take both.

e.g. R2, S3 replication

Immutable backups

Copies that cannot be deleted, even by an attacker with your keys.

e.g. Object lock

Restore testing

Practise restoring on a schedule and time it.

e.g. Restore drills

RPO and RTO

How much data you can lose, and how long you can be down.

e.g. Targets that choose the design

Subscriptions

A fixed price per period, with plans and trials.

e.g. Stripe Billing

Usage-based metering

Count events or units and bill at the end of the period.

e.g. API calls, gigabytes

Invoices and tax

Issue documents and apply the right tax by place.

e.g. VAT, GST

Proration and upgrades

Handle changes in the middle of a period.

e.g. Credits

Dunning

Retry failed payments politely before cancelling.

e.g. Smart retries

Accuracy first

Usage records must be exact and idempotent, because money is involved.

e.g. Ledger, reconciliation

Event tracking

Send an event for each action, with who and what.

e.g. Segment, Snowplow

Funnels and retention

Where people drop off, and who comes back.

e.g. Amplitude, Mixpanel

Experimentation

Randomly show versions and measure the effect.

e.g. A/B platforms

Client and server events

Browser events can be blocked and faked. Server events are more reliable.

e.g. Both, deduplicated

Privacy and consent

Respect choices, minimise data and keep identifiers safe.

e.g. Consent management

Pipeline to the warehouse

Land events in the warehouse for deeper questions.

e.g. Streams, then SQL

Public and private registries

Share open images, keep your own private.

e.g. Docker Hub, ECR, GCR

Image scanning and signing

Check for known flaws and prove who built an image.

e.g. Trivy, Cosign

Tags and digests

Tags move, digests do not. Deploy by digest.

e.g. Immutable references

Pull-through cache

Keep a local copy of public images so builds do not depend on them.

e.g. Mirror registries

Geo-replication

Keep images near the clusters that pull them, so startup is fast.

e.g. Multi-region pulls

Retention

Delete old images to save space and reduce risk.

e.g. Lifecycle policies