Content Delivery Network · Analysis

01 · Frame the problem

Understand the central challenge

Design a CDN for immutable public assets and explicitly private content. Popular objects expire together, origins can fail and cache-key mistakes must not expose private responses.

Caching correctness depends on representation identity, freshness and authorization. Analyse whether an object is publicly reusable, which inputs vary its bytes and how publication or purge changes what an edge may serve.

02 · Find the design pressure

Start simple, then identify the gap

Begin with immutable versioned public assets and explicit cache keys. A generic cache-everything rule leaks private responses or mixes representations. Add private-delivery enforcement and observable purge semantics as separate contracts.

Use edge caches with explicit representation keys, an origin shield for refill isolation and a versioned asset publication policy. Treat private delivery and distributed purge as separate enforced contracts. Normalize allowed hosts, paths and query parameters. Define response cacheability and the exact Vary/access dimensions; bypass shared caching for personalized responses unless isolation is explicitly designed. On a miss, coalesce fills per key and fetch through an origin shield under finite concurrency/deadline budgets. Cache only complete validated responses, with bounded object size and a documented negative-cache policy. Publish public assets under content/version identities with long immutable lifetimes. For mutable keys, use validators and explicit TTLs; purge events carry generation IDs and report propagation status. Authorize private manifest/object requests at the edge or another trusted serving boundary. During origin failure, serve stale content only where its policy permits, never as an authorization bypass.

03 · Define success

Requirements to preserve

Define safe cache keys and cacheability rules.
Coalesce misses and bound origin concurrency.
Use immutable asset versions and explicit purge semantics.
Enforce private-content authorization before serving bytes.

Workload: 50,000 reads/s, 100 writes/s, 1000 B records, 100 ms read p99 target. These are exercise assumptions; the Solution includes capacity formulas.

04 · Identify the correctness boundary

Consistency, ownership and failure boundaries

Define cache identity over all representation-changing inputs and distinguish publicly reusable bytes from authorized private delivery. A shield coalesces origin refills, while immutable versioned paths simplify publication. Purge acknowledgements should report their declared coverage rather than imply instantaneous invalidation at every edge.

05 · Make it concrete

Reason through a worked example

Asset /app/v1.js is cached at many edges. Publishing /app/v2.js allows both immutable versions to coexist. If an urgent purge removes v1, track completion across the supported edge population. A private response must not become a shared hit because its authorization header was omitted from policy.