Problems / Resilience, hard

Stays search and booking: a slow payment provider takes everything down

Asked at Airbnb and Booking.com. One API serves search, listing pages and bookings from one Postgres database, and bookings call the card provider in the same thread pool. At 6 s holiday traffic rises by half; at 10 s the card provider gets eight times slower for 12 seconds, and searches start failing too.

Unlock it once for 25 credits; everything inside it is free (runs, changes, Submit, results, hints). Sign in with Google to start; new accounts get free credits.

Your goals

Success ≥ 99%, p99 ≤ 2.5 s and Apdex ≥ 0.90, for at most $700,000 a month.

Test cases

Like a coding problem, a solution has to pass every case, not just the one it was built for. Submit in the lab runs all 3; 1 of them are hidden until then.

  1. As given. The problem’s own traffic, scheduled failures and seed.
  2. A server dies. One replica of the service with the most replicas is killed for part of the run.

The traffic

10,000 requests a second for 20 seconds: 70% search (reads), 25% listing (reads), 5% book (writes).

The system

What each component does in this design, and what calls it. The simulator mimics each one from these settings.

ComponentIts job hereSettings
Load balancerLoad balancerTraffic enters here.Calls Stays API.Layer 4 balancers route by IP and port; layer 7 balancers read HTTP and can route by path or header.–
Stays APIApp serviceLoad balancer forwards to it.Calls Listings, calendars and bookings (Postgres), Card payments.Little's law: throughput ≈ concurrency ÷ latency. 200 slots at 50 ms serve about 4,000 req/s.16 replicas × 100 slots · timeout 10 s
Listings, calendars and bookings (Postgres)SQL databaseStays API calls it.Postgres runs one process per connection, which is why poolers like PgBouncer sit in front of busy databases.32 vCPU · 800 connections · 2 read replicas
Card paymentsPayment gatewayStays API calls it for /book.Payment providers accept an idempotency key so a retried charge is not taken twice.500 slots

More resilience problems