Develop a Photo Sharing Platform like Flickr or Google Photos — System Design Interview Practice

Interview prompt

Design Design a platform for uploading, organizing, and sharing photos with albums and search. so users can Upload and store photos reliably at scale.

• Define the source of truth for Upload and store photos; Organize photos in albums and make retries idempotent.
• Use bounded, partitioned state to meet Handle billions of photos and Efficient storage for large photos.
• Separate the critical request path from Object storage (S3) for photos, Image processing for thumbnails, Metadata database for search.
• Explain consistency, failure recovery, authorization, observability, and a degraded mode.

Requirements and scale assumptions

• Support the core workflow to Upload and store photos.
• Expose status, results, and freshness appropriate to Design a platform for uploading, organizing, and sharing photos with albums and search..
• Support authorization, validation, updates, deletion, and recovery semantics.
• Meet Efficient storage for large photos under normal load.
• Scale to Handle billions of photos without a single hot key or unbounded synchronous work.
• Do not lose committed state; make retries and duplicate events safe.
• Degrade safely when downstream workers, caches, or external dependencies fail.
• Handle billions of photos
• Partition by the primary tenant, user, item, or geographic key and isolate hot partitions.
• Keep serving state bounded; retain raw events or durable records for replay and auditing.

• Peak scale: Handle billions of photos — Capacity assumption that drives partitioning and backpressure.
• Latency target: Efficient storage for large photos — User-facing budget for the primary request or read path.
• Durable boundary: Committed before async — The source of truth is Upload and store photos; Organize photos in albums.
• Async boundary: At-least-once workers — Keep Object storage (S3) for photos, Image processing for thumbnails, Metadata database for search off the synchronous path.

Key entities

• MediaAssetassetId, ownerId, sourceUri, checksum, privacy, status

  Canonical uploaded photo sharing platform asset and lifecycle state.

• MediaRenditionassetId, profile, codec, uri, checksum, status

  Derived photo sharing platform output identified by a deterministic profile and content hash.

• PlaybackSessionsessionId, assetId, viewerId, entitlementVersion, edgeRegion, expiresAt

  Short-lived photo sharing platform access session that binds authorization to delivery.

• ProcessingJobjobId, assetId, operation, attempt, checkpoint, status

  Retry-safe photo sharing platform processing job with checkpoints and per-rendition progress.

Data flow

1. 1. Reserve a resumable uploadThe photo sharing platform gateway authenticates the owner, reserves metadata, validates size and checksum, and returns a scoped upload URL.
2. 2. Commit and verify the sourceA completion callback verifies the photo sharing platform object, records an immutable checksum, and publishes a processing job only once.
3. 3. Process renditions asynchronouslyWorkers execute photo sharing platform transforms with deterministic profiles, checkpointing, bounded retries, and a dead-letter path for corrupt inputs.
4. 4. Publish an entitlement-aware manifestA manifest projection exposes only completed photo sharing platform renditions and carries policy, checksum, and freshness metadata.
5. 5. Deliver, invalidate, and recoverCDN delivery is protected by expiring URLs and revocation signals; failed photo sharing platform jobs and stale manifests are replayable without duplicating outputs.

Deep dives and trade-offs

• Integrity and idempotent processingUse checksums and immutable source objects for photo sharing platform deduplication and audit. Derive output keys from asset, profile, and transform version so retries cannot corrupt a completed rendition. Make completion callbacks and worker claims conditional on job version and attempt.
• Authorization at the edgeBind photo sharing platform manifests and signed URLs to the viewer, entitlement version, and expiry. Propagate takedown, privacy, and subscription changes to edge caches with bounded revocation delay. Never let a cache hit bypass the policy decision for private or paid content.
• Cost, hot assets, and backpressureSeparate interactive manifest latency from expensive photo sharing platform processing and encode work. Use queue priority, concurrency limits, and lifecycle policies for source and rendition storage. Measure cache hit rate, startup latency, processing backlog, failed bytes, and egress cost by profile.
• Process on upload versus on demandPrecompute common photo sharing platform profiles and generate rare profiles on demand with a durable job state. Generating every possible profile up front wastes storage and processing budget.
• Origin storage versus CDN cachingKeep the origin authoritative and use CDN caching for immutable or versioned outputs with explicit invalidation. A cache cannot be the only copy of a photo sharing platform rendition or the recovery path becomes undefined.
• Quality versus delivery costChoose profiles from device, bandwidth, and business requirements, then measure quality and egress by cohort. Maximal bitrate or resolution can make tail startup and cost unacceptable without improving viewing outcomes.