Problems / Resilience, hard
Checkout calls one payment provider. The API retries failed calls 3 times immediately. At 10 s the provider is down for 15 seconds, and the retries triple the pile-up.
Free to open. Runs in your browser, no sign-up.
Success ≥ 99% through the outage, p99 ≤ 3 s.
300 requests a second for 30 seconds: 90% reads, 10% writes.
What each component does in this design, and what calls it. The simulator mimics each one from these settings.
| Component | Its job here | Settings |
|---|---|---|
| Load balancerLoad balancer | Traffic enters here.Calls API.Layer 4 balancers route by IP and port; layer 7 balancers read HTTP and can route by path or header. | – |
| APIApp service | Load balancer forwards to it.Calls Postgres, Payment API (provider A).Little's law: throughput ≈ concurrency ÷ latency. 200 slots at 50 ms serve about 4,000 req/s. | 3 replicas × 200 slots · timeout 3.0 s |
| PostgresSQL database | API calls it.Postgres runs one process per connection, which is why poolers like PgBouncer sit in front of busy databases. | 8 vCPU · 60 connections |
| Payment API (provider A)External API (mock) | API calls it.Third-party APIs have their own rate limits and outages that you cannot fix. | 400 slots · 60,000 calls/min |
Try it first. Open one hint at a time if you get stuck.
Retries cannot revive a provider that is down; they only hold API slots longer.
What would answer the calls while the provider is down?
Limit retries, and add a fallback provider.
Limit retries to 1 with a budget, and link a second payment API as the fallback.