CDN#

Q: What is a CDN and why use one?

A CDN is a network of geographically distributed edge servers that cache content close to users. It reduces latency, cuts origin egress, and absorbs traffic spikes for static and increasingly dynamic content.

Q: How does a CDN work?

When a user requests a URL, DNS or anycast routes them to the nearest edge POP. If the asset is cached the POP serves it directly; otherwise it fetches from origin, caches it, and serves the user.

Q: What is the difference between CDN and origin?

Origin is the authoritative source of truth, usually a single region or a small set of clusters. CDN is the caching layer at the edge that replicates a subset of origin content close to users.

Q: How is CDN cache invalidated?

Use cache-control headers with TTLs, tag-based purges, or explicit URL purges via API. Long TTLs with versioned URLs (cache busting) are the most reliable pattern at scale.

Q: When should I not use a CDN?

Skip a CDN for tiny single-region apps, fully dynamic uncacheable APIs with per-user data, or strict data-residency workloads where caching at foreign POPs violates compliance.

Problem statement (interviewer prompt)

Design a global content delivery layer that replicates origin assets to edge POPs worldwide. Hot objects must be served in <50ms p99 from the nearest edge; cache invalidation must propagate in seconds; and origin egress should drop by 90%+ for static workloads.

A CDN replicates origin content to globally distributed edge POPs so clients hit a nearby cache instead of the origin.

flowchart LR
  U1([User EU])
  U2([User US])
  U3([User APAC])
  E1[Edge POP EU]
  E2[Edge POP US]
  E3[Edge POP APAC]
  O[Origin]
  U1 --> E1
  U2 --> E2
  U3 --> E3
  E1 -. miss .-> O
  E2 -. miss .-> O
  E3 -. miss .-> O

    classDef client fill:#dbeafe,stroke:#1e40af,stroke-width:1px,color:#0f172a;
    classDef edge fill:#cffafe,stroke:#0e7490,stroke-width:1px,color:#0f172a;
    classDef service fill:#fef3c7,stroke:#92400e,stroke-width:1px,color:#0f172a;
    classDef datastore fill:#fee2e2,stroke:#991b1b,stroke-width:1px,color:#0f172a;
    classDef cache fill:#fed7aa,stroke:#9a3412,stroke-width:1px,color:#0f172a;
    classDef queue fill:#ede9fe,stroke:#5b21b6,stroke-width:1px,color:#0f172a;
    classDef compute fill:#d1fae5,stroke:#065f46,stroke-width:1px,color:#0f172a;
    classDef storage fill:#e5e7eb,stroke:#374151,stroke-width:1px,color:#0f172a;
    classDef external fill:#fce7f3,stroke:#9d174d,stroke-width:1px,color:#0f172a;
    classDef obs fill:#f3e8ff,stroke:#6b21a8,stroke-width:1px,color:#0f172a;
    class U1,U2,U3 client;
    class E1,E2,E3 edge;
    class O service;

flowchart TB
  subgraph Clients
    C1([Browser])
    C2([Mobile App])
  end

  subgraph DNS_Steering[DNS / Anycast Steering]
    GDNS([GeoDNS + EDNS Client Subnet])
    Any[Anycast routing<br/>BGP]
  end

  subgraph Edge[Edge POP, hundreds globally]
    direction TB
    EL[Edge L7 Proxy<br/>NGINX / Envoy / ATS]
    L1[L1 Cache<br/>tmpfs / NVMe<br/>hot]
    L2[L2 Cache<br/>SSD<br/>warm]
    WAF[WAF / DDoS scrubbing]
    BOT[Bot mgmt / TLS termination]
    EW([Edge Workers<br/>WASM / JS at edge])
  end

  subgraph Mid[Mid / Shield Tier]
    MT([Mid-tier cache<br/>regional aggregator])
  end

  subgraph Origin
    OLB[Origin LB]
    OS[Origin Storage<br/>S3 / GCS]
    OAPI[Origin Dynamic API]
  end

  subgraph Control[Control Plane]
    CP[Config / Rules]
    PURGE[Purge / Invalidation<br/>tag-based + URL]
    CERT[Cert Mgmt<br/>ACME / SNI]
    LOG[Real-time Logs &<br/>Analytics pipeline]
  end

  C1 --> GDNS
  C2 --> GDNS
  GDNS --> Any
  Any --> EL
  EL --> WAF
  WAF --> BOT
  BOT --> EW
  EW -->|cache lookup| L1
  L1 -->|miss| L2
  L2 -->|miss| MT
  MT -->|miss| OLB
  OLB --> OS
  OLB --> OAPI
  CP -.push config.-> EL
  PURGE -.invalidate.-> L1
  PURGE -.invalidate.-> L2
  PURGE -.invalidate.-> MT
  CERT -.certs.-> EL
  EL -.access logs.-> LOG

    classDef client fill:#dbeafe,stroke:#1e40af,stroke-width:1px,color:#0f172a;
    classDef edge fill:#cffafe,stroke:#0e7490,stroke-width:1px,color:#0f172a;
    classDef service fill:#fef3c7,stroke:#92400e,stroke-width:1px,color:#0f172a;
    classDef datastore fill:#fee2e2,stroke:#991b1b,stroke-width:1px,color:#0f172a;
    classDef cache fill:#fed7aa,stroke:#9a3412,stroke-width:1px,color:#0f172a;
    classDef queue fill:#ede9fe,stroke:#5b21b6,stroke-width:1px,color:#0f172a;
    classDef compute fill:#d1fae5,stroke:#065f46,stroke-width:1px,color:#0f172a;
    classDef storage fill:#e5e7eb,stroke:#374151,stroke-width:1px,color:#0f172a;
    classDef external fill:#fce7f3,stroke:#9d174d,stroke-width:1px,color:#0f172a;
    classDef obs fill:#f3e8ff,stroke:#6b21a8,stroke-width:1px,color:#0f172a;
    class C1,C2,GDNS client;
    class Any,EL,WAF,BOT,OLB edge;
    class L1,L2,OAPI,CP,PURGE,CERT service;
    class EW,MT compute;
    class OS storage;
    class LOG obs;

Caching keys & TTLs#

Key = (host, path, query-allowlist, vary-headers).
Cache-Control: public, max-age=... and s-maxage for shared caches.
Stale-while-revalidate / stale-if-error for resilience.
Range requests + byte-range slicing for large video objects.

Invalidation#

URL purge, surrogate-key (cache-tag) purge, full purge.
Soft purge marks stale; cleanup on next request.

Pricing/perf knobs#

Tiered caching: edge → shield → origin (origin shielding).
Pre-fetch hot objects to edges by analytics.
HTTP/3 + 0-RTT for cold-start latency.

Glossary & fundamentals#

Concepts referenced in this design. Each row links to its canonical page; the tag column shows whether it is a high-level (HLD) or low-level (LLD) concept.

Tag	Concept	What it is	Page
`HLD`	Load balancer / GSLB	L4/L7 traffic distribution and failover	load-balancer
`HLD`	CDN	edge caching for static assets	cdn
`HLD`	Cache strategies	cache-aside, read/write-through, eviction	caching-strategies
`HLD`	HTTP / TLS protocols	HTTP 1.1/2/3, QUIC, TLS 1.3	http-protocols
`LLD`	Structural patterns	Adapter, Decorator, Facade, Proxy, Composite	structural-patterns

Quick reference#

Functional requirements#

Cache static assets globally; serve nearest POP.
Origin shielding to reduce origin egress.
Purge by URL, surrogate key, or full domain.
TLS termination at edge.
Optional: edge compute (WASM/JS), WAF, image resize at edge.

Non-functional requirements#

Hit ratio: > 90% for static workloads.
p99 latency: < 50 ms to nearest POP.
Availability: 99.99% (route around POP failures via anycast).
Throughput: Tb/s aggregate.

Capacity estimation#

1 PB working set, edge SSD 50 TB/POP → ~20 POPs cover hot set.
Origin egress reduction: 95% if hit ratio = 95%.

API surface#

HTTP origin pull (most common) or push API.
Control API: PUT /config, POST /purge {urls, tags}.

Data / cache key model#

key = SHA1(host + path + sorted(query_allowlist) + vary_headers)
Metadata: etag, last-modified, expiry, surrogate-keys[].

Trade-offs#

Push vs Pull: Pull = simple, lazy population; Push = predictable but costly to seed.
More POPs = lower latency, higher cost, more cache fragmentation.
Long TTL = high hit ratio but stale risk; pair with surrogate-key purge.
Edge compute = personalization at edge but complicates caching.

Real-world refs#

Akamai (origin shielding pioneer), Cloudflare (anycast + Workers), Fastly (instant purge, VCL), AWS CloudFront, Google Cloud CDN, Netflix Open Connect.

FAQ#

What is a CDN and why use one?#