Context Deadlines and How to Set Them

Summary

Microservice architectures operating under heavy network traffic require robust timeout handling to prevent slow or failing dependencies from causing cascading failures across services. Naive, static timeout configurations across a call chain often cause downstream components to waste compute effort on requests that upstream callers have already abandoned. To establish predictable timeout thresholds, engineers can align limits with service-level latency percentiles, pairing P99 limits with median latency retry allowances. Go's context package improves upon static network timeouts by propagating request-scoped deadlines and cancellation signals across service boundaries. This distributed context ensures downstream servers recognize remaining time budgets and terminate unneeded processing immediately when parent deadlines expire or callers manually cancel requests.

Context

Grab's microservice architecture handles high network traffic where network issues cause API calls to fail or slow down, and poor timeout configurations risk cascading failure across services.

Approach / What changed

Configuring timeouts using service-level agreement latency percentiles with retries, and using Go's context package to propagate deadlines and cancellation signals across API boundaries.

Takeaways

• Setting timeout durations using latency percentiles like P99 combined with median latency retries establishes predictable request limits while reducing the failure rate.
• Go context propagation acts as a distributed timeout, allowing downstream services to calculate remaining processing time and avoid wasting compute on abandoned calls.
• A 'context cancelled' error originates from an upstream client's manual cancellation, whereas a 'context deadline exceeded' error indicates that a local or propagated deadline expired.

Related reading

• Grab · Dec 21, 2018

  Designing Resilient Systems: Circuit Breakers or Retries? (Part 1)

  Distributed architectures frequently encounter upstream failures triggered by networking issues, system overloads, resource starvation, and invalid deployments. Implementing software circuit breakers interposes a monitoring mechanism between components to halt requests when failure thresholds are met, giving struggling upstream dependencies time to recover. Circuit breakers save CPU, memory, and network resources by failing fast or routing execution through defined fallbacks such as cached data, alternate services, or approximation algorithms. Grab utilizes Hystrix-Go to manage upstream interactions and configure key thresholds for concurrency, timeouts, and error ratios. This approach protects downstream consumers from cascading latency while insulating upstream resources from excess traffic.

  Corey Scott

• Grab · Mar 20, 2019

  Designing Resilient Systems Beyond Retries (Part 1): Rate-Limiting

  Distributed systems that rely exclusively on retries and circuit breakers face severe failure risks, including retry storms and reliance on client-side configuration accuracy. Implementing server-side rate limiting serves as a critical defensive layer to safeguard services across evolving architectures. Throttling thresholds can be layered across per-client, per-endpoint, and server-wide granularities using algorithms such as leaky bucket or sliding windows. While local instance-level limits fail when downstream bottlenecks like databases saturate under horizontal scaling, global rate limiting coordinates traffic enforcement across entire service pools. Centralized rate limiters require asynchronous communication and fallback mechanisms to avoid becoming single points of failure or adding request path latency.

  Michael Cartmell

• Grab · Mar 27, 2019

  Designing Resilient Systems Beyond Retries (Part 3): Architecture Patterns and Chaos Engineering

  Building resilient systems requires architectural safeguards and proactive testing beyond basic retries and circuit breakers. Architectural patterns such as idempotency keys enable safe retries without creating inconsistent state during failures. Asynchronous responses and deferrable work isolate services from downstream dependency latency and errors, though they can conflict with the fail-fast principle. To validate system behavior under stress, chaos engineering introduces intentional failures in production to test hypotheses against a defined steady state. Selectively adopting complementary patterns reduces failure points while avoiding unnecessary architectural complexity.

  Michael Cartmell

• Grab · Jan 8, 2019

  Designing Resilient Systems: Circuit Breakers or Retries? (Part 2)

  Retries enable software systems to recover from transient upstream failures by automatically repeating unsuccessful requests. While retrying increases the chance of request completion across multi-host setups, it consumes additional CPU and time without inherently tracking host health. Applications must selectively retry errors with a likelihood of success, such as 500 and 503 status codes, while avoiding client-side failures like 400 or 401. To manage distributed systems safely, retries require idempotent operations or cryptographic nonces, along with backoff and jitter to prevent request stampedes. Tuning retry counts, timeouts, and delays is critical to cap the worst-case consumer response time.

  Corey Scott