Design Netflix

1 · Clarifying questions

2 · Capacity math, on a napkin

The single most important number: 1 Pbps egress at peak. No commercial CDN provider can sustain that for one customer at reasonable cost. The reason Open Connect exists at all is bandwidth economics — at this volume, building your own CDN is cheaper than paying anyone else's.

3 · API and data model

Player ↔ control plane

GET  /v1/home                          # personalised rows for the home screen
  → 200 { "rows": [{"title": "Continue Watching", "items": [...]}, ...] }

GET  /v1/title/:id                     # title page metadata
  → 200 { "id": ..., "synopsis": ..., "episodes": [...], "available_until": "..." }

POST /v1/playback/start                # tap-to-play
{ "title_id": "t_...", "device": {...}, "client_caps": {"codecs": [...], "max_bitrate": ...} }
  → 200 {
    "session_id": "s_...",
    "manifest_url": "https://oca-region.../manifest.mpd",
    "drm_license_url": "https://...",
    "resume_at": 1820
  }

POST /v1/playback/heartbeat            # every 30 s during playback
{ "session_id": "s_...", "position_ms": ..., "bitrate": ..., "rebuffers": ... }
  → 204

POST /v1/playback/end                  # tab closed / video ended
{ "session_id": "s_...", "position_ms": ..., "complete": true }

Storage (control plane)

titles                          -- regional master catalog
  title_id        UUID PK
  type            VARCHAR(16)    -- movie | series | episode
  parent_id       UUID NULL      -- for episodes → series
  region          VARCHAR(8)
  rights_until    TIMESTAMP
  metadata        JSONB

variants                        -- one row per encoded artifact
  variant_id      UUID PK
  title_id        UUID
  codec           VARCHAR(16)    -- h264 | h265 | av1
  resolution      VARCHAR(8)     -- 240p .. 2160p
  bitrate_kbps    INT
  hdr             BOOLEAN
  duration_ms     BIGINT
  manifest_key    TEXT           -- key in object store
  segment_count   INT

profiles                        -- per-account profile
  profile_id      UUID PK
  account_id      UUID
  display_name, avatar_url
  maturity_rating VARCHAR(8)

viewing_history                 -- Cassandra; partitioned by profile_id
  profile_id, title_id, watched_at
  position_ms, complete
  device, region
  PRIMARY KEY ((profile_id), watched_at DESC, title_id)

recommendation_cache            -- materialised per profile, refreshed nightly
  profile_id      UUID
  rows            JSONB          -- precomputed home-screen rows

4 · High-level architecture

Player asks the edge gateway to start playback. Playback service authenticates, fetches the title's manifest, asks the routing service for the best Open Connect appliance for this client's network. OCAs are pre-filled with the catalog (the long tail of titles is on S3 in case of cache miss). The player downloads HLS/DASH segments directly from the OCA; the control plane sees only heartbeat + start/stop events.

5 · The hard part — Open Connect, the CDN

Why a private CDN?

At 1 Pbps peak egress, commercial CDN pricing falls apart. Netflix's solution: ship physical cache boxes (OCAs — Open Connect Appliances) to ISPs and exchange points. ISPs install them inside their own networks. When a Netflix subscriber on that ISP starts a stream, the bytes never leave the ISP's network. The ISP saves on transit; Netflix saves on egress; the user gets better quality.

• OCA hardware. Custom-built dense storage (~250 TB per box, ~100 Gbps serving). Open Connect is FreeBSD-based for the network stack.
• Fill window. Each night during low-traffic hours, OCAs pull the next day's expected titles from regional S3 mirrors. Popularity-weighted; the long tail stays at S3.
• Routing. Player asks the routing service. Service knows which OCAs are reachable for this client (BGP + geolocation), which ones have the requested title, and which one is least loaded. Returns a sorted list of 3 — the player falls back if the first fails.

Adaptive bitrate (ABR)

Video is encoded into a ladder of variants — same title, multiple resolutions and bitrates. The manifest lists them. The player measures throughput and switches between variants on segment boundaries (every 2–10 s) to maximise quality while avoiding rebuffer.

# Simplified MPEG-DASH manifest excerpt
<MPD>
  <Period>
    <AdaptationSet contentType="video">
      <Representation id="240p"  bandwidth="400000"  width="426"  height="240">
        <SegmentList timescale="1000" duration="2000"> ... </SegmentList>
      </Representation>
      <Representation id="480p"  bandwidth="1000000" width="854"  height="480">  ...  </Representation>
      <Representation id="720p"  bandwidth="2800000" width="1280" height="720">  ...  </Representation>
      <Representation id="1080p" bandwidth="5000000" width="1920" height="1080"> ...  </Representation>
      <Representation id="4k"    bandwidth="16000000" width="3840" height="2160"> ... </Representation>
    </AdaptationSet>
  </Period>
</MPD>

# Per-shot encoding — Netflix's special sauce
# Instead of a fixed bitrate per resolution, each scene gets its own bitrate
# based on how compressible it is. A talking-head scene at 1080p might be
# 1 Mbps; an action scene at the same resolution might be 8 Mbps.

DRM

Studios require it. Three DRM systems (Widevine for Android/Chrome, FairPlay for Apple, PlayReady for Edge/consoles). License acquired separately from segments; tied to the playback session. The license carries usage rules: max output resolution per device class, offline-download expiry, screen-recording protection.

6 · The encoding pipeline

A new title arrives as a mastered file (~50 GB, ProRes 422 HQ). Encoding produces ~50 variants spread across codecs (H.264, H.265, AV1), resolutions (240p..2160p), HDR vs SDR, and audio (stereo, 5.1, Atmos). Each variant is segmented into 2–10 s chunks and packaged into HLS + DASH formats. Total encoding compute per title: ~5,000 CPU hours.

• Per-shot encoding. Detect scene boundaries, encode each scene with bitrate matched to its complexity. Saves ~20% bandwidth at the same perceptual quality. The data-engineering layer behind this is enormous.
• Quality measurement. Every variant gets a VMAF score (perceptual quality metric). Variants below threshold are re-encoded with different parameters.
• Distribution. Encoded variants land in regional S3. The OCA fill service consumes from there.

This pipeline is offline. A new title takes hours to days from arrival to playable; the SLO is "ready 24 hours before scheduled release."

7 · Recommendations

A different system entirely. Two layers:

• Offline candidate generation. Per profile, nightly job produces a candidate set of ~500 titles using collaborative filtering + content-based signals. Stored in the recommendation cache.
• Online ranking. At browse time, the recs service fetches the candidate set, runs a real-time ranker (fast model that uses context: time-of-day, device, recent watches), and returns the top-N for each row. Adds ~10 ms to the home-screen response.

Row ordering and row composition (Continue Watching, Because You Watched, Trending, Top 10) is itself a separate ML problem. Netflix runs continuous A/B tests on row design.

8 · Failure modes & runbook

9 · Cost & SLOs

SLOs

• Start-up time P99: 2 s. Tap-to-play.
• Rebuffer rate: < 0.5%. Per stream; the headline quality metric.
• Browse P99: 300 ms. Home screen render.
• Availability: 99.99%. Control plane; data plane higher.
• Encoding ready: 24 h before scheduled release. Hard SLO.

10 · Trade-offs & "what would you change at 10×"

Further reading

• Netflix Technology Blog — multi-year archive on every layer of this design. The single best primary source for any video-streaming system design.
• "How Netflix Works with ISPs" — Open Connect public site. The OCA partnership model explained.
• "Per-Title Encode Optimization" — Netflix Tech Blog. The per-shot encoding story; required reading.
• "Chaos Engineering" — Netflix-authored book. The discipline that came out of running this system reliably.
• Adjacent: Object storage. The master + variant tier.
• Adjacent: CDN. The general pattern; Open Connect is the bespoke version.
• Adjacent: Scale to millions on AWS. The control-plane evolution story.