Design Netflix

Problem Statement & Netflix VOD Context

Netflix is a global subscription video-on-demand platform, and the word that separates it from YouTube is curated: a professionally-produced catalog of finite size, licensed per territory, streamed to paying subscribers. There is no user upload and no million-to-one ingest problem. The hard problems shift to three places — flawless playback at enormous concurrency, personalized discovery over a catalog you have already licensed, and the legal-and-technical machinery of DRM and regional rights.

The defining architectural split is control plane versus data plane. Browsing, search, entitlement checks, and recommendations run through regional control APIs that return small JSON; the actual video bytes never flow through those services. Bytes are served from Open Connect, Netflix's own CDN of cache appliances physically embedded inside ISP networks, often a single network hop from the subscriber. A play-start request hits the control plane only to verify entitlement, sign a manifest, fetch a short-lived DRM license URL, and pick the best Open Connect hostname; from there the player streams CMAF segments directly from the ISP-resident cache. Keeping the recommendation ML and other heavy services off the play-start critical path is the single most important latency decision here — play-start p95 must stay low even when personalization is slow or degraded.

The constraint that shapes the catalog layer, and the one candidates most often get wrong, is that licensing is not a global boolean. A title is available in a set of territories during a contracted window — Netflix models these as "Regional Offers" — so the same catalog row is visible in the US, dark in Germany, and expiring next month in Japan. Model it as per-territory, time-bounded availability from day one, because retrofitting global-licensing assumptions later means rewriting search, the home page, and entitlement all at once.

Scale here is about concurrency, not upload volume. A blockbuster launch can push past 50 million simultaneous streams, so the session registry, the entitlement gate (which enforces per-plan concurrent-stream limits), and Open Connect's pre-positioned fill must all be sized for the peak. And because the bytes are pre-encoded and mostly static, Netflix can do something YouTube cannot: proactively fill the edge caches with a new season overnight, before anyone presses play, so launch night is a cache-read rather than a cache-miss stampede. Per-title encoding refines this further — an action title gets a higher-bitrate ladder than a dialogue-heavy drama, so bits are spent where complexity actually demands them. Anchor the whole design on measurable SLIs — play-start p95, rebuffer ratio per ISP/ASN, and catalog freshness — and every later decision has something concrete to serve.