Distributed-system Patterns Reference
Intent, fit, trade-offs, and relationships for resilient distributed systems.
Updated 2026-07-22
Timeout
Bound how long a caller waits for an operation.
| Aspect | Guidance |
|---|---|
| Use when | Remote or resource-bound work may stall beyond useful latency. |
| Trade-offs | A timeout does not cancel server work and poor thresholds create false failures. |
| Related | Retry, Circuit Breaker |
Retry
Repeat transiently failed operations with a limit, backoff, and jitter.
| Aspect | Guidance |
|---|---|
| Use when | Failures are temporary and operations are safe to repeat. |
| Trade-offs | Retries amplify overload and can duplicate non-idempotent effects. |
| Related | Timeout, Circuit Breaker, Idempotent Consumer |
Circuit Breaker
Fail fast after repeated dependency failures, then probe for recovery.
| Aspect | Guidance |
|---|---|
| Use when | Continuing calls would waste resources or worsen a failing dependency. |
| Trade-offs | Thresholds and recovery states add complexity and can reject healthy calls. |
| Related | Retry, Bulkhead |
Bulkhead
Partition capacity so one workload or dependency cannot exhaust all resources.
| Aspect | Guidance |
|---|---|
| Use when | Failures need isolation by tenant, endpoint, or dependency. |
| Trade-offs | Reserved capacity may sit idle and limits require tuning. |
| Related | Rate Limiting, Circuit Breaker |
Rate Limiting
Control how much work a caller or system may submit over time.
| Aspect | Guidance |
|---|---|
| Use when | Capacity, fairness, cost, or abuse must be bounded. |
| Trade-offs | Bursts and distributed counters complicate accuracy; rejected clients need guidance. |
| Related | Backpressure, Bulkhead |
Backpressure
Propagate saturation toward producers so demand follows available capacity.
| Aspect | Guidance |
|---|---|
| Use when | Asynchronous pipelines can otherwise accumulate unbounded work. |
| Trade-offs | Requires an end-to-end signal and a policy for slowing, buffering, or dropping. |
| Related | Rate Limiting, Load Balancing |
Service Discovery
Resolve a logical service name to currently healthy instances.
| Aspect | Guidance |
|---|---|
| Use when | Instances change dynamically under deployment, scaling, and failure. |
| Trade-offs | Registry freshness, startup ordering, and split-brain behavior matter. |
| Related | Health Check, Load Balancing |
Load Balancing
Distribute work across eligible instances using a routing policy.
| Aspect | Guidance |
|---|---|
| Use when | Multiple instances provide scale or availability. |
| Trade-offs | Unequal work, session state, and stale health information reduce balance quality. |
| Related | Service Discovery, Health Check |
Leader Election
Select one participant to coordinate an operation for a bounded term.
| Aspect | Guidance |
|---|---|
| Use when | Exactly one active coordinator is required at a time. |
| Trade-offs | Leases, fencing, and network partitions must prevent stale leaders from acting. |
| Related | Quorum, Consensus |
Sidecar
Deploy supporting capabilities in a companion process beside each service instance.
| Aspect | Guidance |
|---|---|
| Use when | Networking, telemetry, or policy should be shared without changing application code. |
| Trade-offs | Adds resource use, deployment coupling, and another failure boundary. |
| Related | Service Mesh, Ambassador |
Strangler Fig
Replace a legacy system incrementally by redirecting slices of behavior.
| Aspect | Guidance |
|---|---|
| Use when | A big-bang rewrite is too risky. |
| Trade-offs | The transition boundary and duplicate models may persist longer than planned. |
| Related | Anti-corruption Layer, Facade |
Replication
Maintain copies of data on multiple nodes.
| Aspect | Guidance |
|---|---|
| Use when | Reads need scale, locality, or tolerance of node failure. |
| Trade-offs | Consistency, conflict resolution, lag, and failover become explicit concerns. |
| Related | Quorum, Sharding |
Quorum
Require overlapping subsets of replicas for reads, writes, or decisions.
| Aspect | Guidance |
|---|---|
| Use when | The system balances consistency and availability across replica failures. |
| Trade-offs | Higher quorum sizes increase latency and partitions can prevent progress. |
| Related | Replication, Leader Election |
Saga
Coordinate a business transaction as local commits followed by messages and compensations.
| Aspect | Guidance |
|---|---|
| Use when | A transaction spans services that cannot share an ACID transaction. |
| Trade-offs | Intermediate states are visible and compensations are domain-specific, not true rollback. |
| Related | Transactional Outbox, Process Manager |
CQRS
Use separate models for commands that change state and queries that read it.
| Aspect | Guidance |
|---|---|
| Use when | Read and write needs differ materially in shape, scale, or consistency. |
| Trade-offs | Duplication, synchronization, and eventual consistency add operational cost. |
| Related | Event Sourcing, Materialized View |
Event Sourcing
Persist state as an ordered history of domain events.
| Aspect | Guidance |
|---|---|
| Use when | Audit history, temporal reconstruction, or event-driven projections are core needs. |
| Trade-offs | Event evolution, replay, storage growth, and debugging require discipline. |
| Related | CQRS, Snapshot |
Transactional Outbox
Write business state and an outgoing-message record in the same local transaction.
| Aspect | Guidance |
|---|---|
| Use when | Database changes and message publication must not diverge. |
| Trade-offs | A relay, cleanup, ordering, and duplicate delivery still need handling. |
| Related | Saga, Idempotent Consumer |
Idempotent Consumer
Ensure repeat deliveries produce the same logical outcome as one delivery.
| Aspect | Guidance |
|---|---|
| Use when | A broker or retry policy can deliver messages more than once. |
| Trade-offs | Deduplication state, identity, and retention windows add storage and design cost. |
| Related | Transactional Outbox, Retry |
Health Check
Report whether an instance is alive and ready to receive work.
| Aspect | Guidance |
|---|---|
| Use when | Orchestrators and routers must avoid unhealthy or unready instances. |
| Trade-offs | Overly shallow checks lie; deep checks can cascade dependency failures. |
| Related | Service Discovery, Load Balancing |
Correlation ID
Attach one identifier to related work across process and message boundaries.
| Aspect | Guidance |
|---|---|
| Use when | Logs, traces, and support workflows must reconstruct a distributed operation. |
| Trade-offs | Every boundary must propagate it safely without treating it as authentication. |
| Related | Distributed Tracing, Request ID |