Netflix: Limit the Number of Screens Each User Can Watch — System Design Interview Practice

Interview prompt

Design Design a system to enforce concurrent streaming limits per user account. so users can Track active streaming sessions per account reliably at scale.

• Define the source of truth for Track active streaming sessions per account; Enforce screen limits (e.g., 2, 4 screens) and make retries idempotent.
• Use bounded, partitioned state to meet Handle millions of concurrent users and Low latency for session validation.
• Separate the critical request path from Distributed session store (Redis), Heartbeat mechanism for active sessions, TTL for session expiration.
• Explain consistency, failure recovery, authorization, observability, and a degraded mode.

Requirements and scale assumptions

• Support the core workflow to Track active streaming sessions per account.
• Expose status, results, and freshness appropriate to Design a system to enforce concurrent streaming limits per user account..
• Support authorization, validation, updates, deletion, and recovery semantics.
• Meet Low latency for session validation under normal load.
• Scale to Handle millions of concurrent users without a single hot key or unbounded synchronous work.
• Do not lose committed state; make retries and duplicate events safe.
• Degrade safely when downstream workers, caches, or external dependencies fail.
• Handle millions of concurrent users
• Partition by the primary tenant, user, item, or geographic key and isolate hot partitions.
• Keep serving state bounded; retain raw events or durable records for replay and auditing.

• Peak scale: Handle millions of concurrent users — Capacity assumption that drives partitioning and backpressure.
• Latency target: Low latency for session validation — User-facing budget for the primary request or read path.
• Durable boundary: Committed before async — The source of truth is Track active streaming sessions per account; Enforce screen limits (e.g., 2, 4 screens).
• Async boundary: At-least-once workers — Keep Distributed session store (Redis), Heartbeat mechanism for active sessions, TTL for session expiration off the synchronous path.

Key entities

• MediaAssetassetId, ownerId, sourceUri, checksum, privacy, status

  Canonical uploaded netflix limit the number of screens each user can watch asset and lifecycle state.

• MediaRenditionassetId, profile, codec, uri, checksum, status

  Derived netflix limit the number of screens each user can watch output identified by a deterministic profile and content hash.

• PlaybackSessionsessionId, assetId, viewerId, entitlementVersion, edgeRegion, expiresAt

  Short-lived netflix limit the number of screens each user can watch access session that binds authorization to delivery.

• ProcessingJobjobId, assetId, operation, attempt, checkpoint, status

  Retry-safe netflix limit the number of screens each user can watch processing job with checkpoints and per-rendition progress.

Data flow

1. 1. Reserve a resumable uploadThe netflix limit the number of screens each user can watch gateway authenticates the owner, reserves metadata, validates size and checksum, and returns a scoped upload URL.
2. 2. Commit and verify the sourceA completion callback verifies the netflix limit the number of screens each user can watch object, records an immutable checksum, and publishes a processing job only once.
3. 3. Process renditions asynchronouslyWorkers execute netflix limit the number of screens each user can watch transforms with deterministic profiles, checkpointing, bounded retries, and a dead-letter path for corrupt inputs.
4. 4. Publish an entitlement-aware manifestA manifest projection exposes only completed netflix limit the number of screens each user can watch renditions and carries policy, checksum, and freshness metadata.
5. 5. Deliver, invalidate, and recoverCDN delivery is protected by expiring URLs and revocation signals; failed netflix limit the number of screens each user can watch jobs and stale manifests are replayable without duplicating outputs.

Deep dives and trade-offs

• Integrity and idempotent processingUse checksums and immutable source objects for netflix limit the number of screens each user can watch deduplication and audit. Derive output keys from asset, profile, and transform version so retries cannot corrupt a completed rendition. Make completion callbacks and worker claims conditional on job version and attempt.
• Authorization at the edgeBind netflix limit the number of screens each user can watch manifests and signed URLs to the viewer, entitlement version, and expiry. Propagate takedown, privacy, and subscription changes to edge caches with bounded revocation delay. Never let a cache hit bypass the policy decision for private or paid content.
• Cost, hot assets, and backpressureSeparate interactive manifest latency from expensive netflix limit the number of screens each user can watch processing and encode work. Use queue priority, concurrency limits, and lifecycle policies for source and rendition storage. Measure cache hit rate, startup latency, processing backlog, failed bytes, and egress cost by profile.
• Process on upload versus on demandPrecompute common netflix limit the number of screens each user can watch profiles and generate rare profiles on demand with a durable job state. Generating every possible profile up front wastes storage and processing budget.
• Origin storage versus CDN cachingKeep the origin authoritative and use CDN caching for immutable or versioned outputs with explicit invalidation. A cache cannot be the only copy of a netflix limit the number of screens each user can watch rendition or the recovery path becomes undefined.
• Quality versus delivery costChoose profiles from device, bandwidth, and business requirements, then measure quality and egress by cohort. Maximal bitrate or resolution can make tail startup and cost unacceptable without improving viewing outcomes.