Design Ephemeral Environments

Ephemeral Preview Environments per PR

Context

Vercel, Netlify, and Railway popularized per-branch preview URLs—interviews want your control plane: webhook-driven environment stacks, dependency-ordered provisioning, masked data branches, cost quotas, and deterministic teardown when PRs close.

Mechanisms you must articulate

Lifecycle — open PR → queue job → provision waves → health/smoke → post preview URL → destroy on close/TTL.
Isolation — dedicated namespace or account slice, NetworkPolicy, scoped IAM, no prod secrets.
Data — DB branch/snapshot with PII mask; object-store prefixes per env_id.
Idempotency — Idempotency-Key on create; webhook dedupe by delivery id.

Topic focus

PR-open triggers isolated stacks with unique URLs, seeded data, and automatic teardown on merge or TTL.

Numbers (state aloud)

500 engineers, ~120 open PRs peak, ~40 new provisions/hour burst.
p95 time-to-preview < 12 minutes for 6-service slice; full 40-service graph may use selective deploy.
Cost cap: $12/day per env default TTL 72h; cluster autoscaler scales 0–80 preview nodes.

Interview closer

Tie Ephemeral Preview Environments per PR to cost + security: ephemeral systems fail interviews when they leak prod data or leave orphan namespaces billing overnight.

javaOne Dark Pro

1 public final class EnvironmentGate {
2   public boolean markReady(HealthReport report, CostBudget budget) {
3     return report.smokeTestsPassed() && !budget.isExceeded() && report.allWavesSucceeded();
4   }
5 }

pythonOne Dark Pro

1 def should_destroy(event: str, ttl_expired: bool) -> bool:
2     if event in ("pull_request.closed", "pull_request.merged"):
3         return True
4     return ttl_expired

typescriptOne Dark Pro

1 export function previewUrl(envId: string, baseDomain: string): string {
2   return "https://" + envId + "." + baseDomain;
3 }

How to open this one

The framing that signals depth on ephemeral preview environments is the per-PR lifecycle as a control plane: open a PR → provision an isolated stack in dependency order → post a preview URL → deterministically tear it down on close or TTL. Lead with isolation (dedicated namespace or account slice, scoped IAM, no prod secrets, masked data) and the failure story that proves it: a leaked or never-torn-down environment racks up cost or exposes data. That shows you understand the hard parts are isolation and guaranteed teardown, not spinning things up.

Key Highlights

•Provision on PR open; destroy on close or TTL—never leave orphans.
•Mask or branch data; never attach raw prod PII to previews.
•Health gates before posting preview URL in PR comments.
•Quota per team prevents 120 namespaces from exhausting the cluster.

Problem Statement: Ephemeral Preview Environments per PR