Designing Resilient Systems Beyond Retries (Part 1): Rate-Limiting

Summary

Distributed systems that rely exclusively on retries and circuit breakers face severe failure risks, including retry storms and reliance on client-side configuration accuracy. Implementing server-side rate limiting serves as a critical defensive layer to safeguard services across evolving architectures. Throttling thresholds can be layered across per-client, per-endpoint, and server-wide granularities using algorithms such as leaky bucket or sliding windows. While local instance-level limits fail when downstream bottlenecks like databases saturate under horizontal scaling, global rate limiting coordinates traffic enforcement across entire service pools. Centralized rate limiters require asynchronous communication and fallback mechanisms to avoid becoming single points of failure or adding request path latency.

Context

At scale, reliance on retries risks triggering retry storms, while circuit breakers depend on error-prone client-side configurations that servers cannot safely trust to prevent service overloads.

Approach / What changed

Deploying layered rate limiting across per-client, per-endpoint, and server-wide thresholds, backed by centralized global rate limiters like Grab's Quotas service alongside optional client-side quota headers.

Takeaways

• Local instance-level rate limiting is ineffective against downstream resource exhaustion because horizontal scaling increases total aggregate pressure on databases and dependent services.
• Layering rate limits across per-client-per-endpoint, per-client, per-endpoint, and server-wide rules captures individual SLA adherence while defending against overall server overhead.
• Centralized rate-limiting systems must process metrics asynchronously or support local fallbacks to avoid becoming single points of failure and adding latency to the request path.

Related reading

• Grab · Mar 25, 2019

  Designing Resilient Systems Beyond Retries (Part 2): Bulkheading, Load Balancing, and Fallbacks

  Software systems require mechanisms beyond retries to maintain resilience during downstream outages and high traffic. Bulkheading isolates failures across infrastructure, processes, thread pools, and connection limits, preventing a single failing component from degrading an entire system. Load balancing distributes traffic across backend pools via proxies, client-side libraries, lookaside services, or sidecars, often pairing with health checks to eliminate single points of failure. When operations fail unrecoverably, fallback strategies like silent failures, local defaults, stale cache reads, and dedicated backup services enable graceful degradation. Organizations like Grab implement these approaches using internal client-side load balancers backed by etcd, cache fallbacks in microservice frameworks, and redundant core backup services.

  Michael Cartmell

• Grab · Aug 10, 2018

  How We Designed the Quotas Microservice to Prevent Resource Abuse

  As Grab migrated from a monolith to hundreds of microservices, managing global rate limiting became essential to prevent cascading failures and resource exhaustion. To avoid putting a rate limiting service on the critical path of every API call, Grab built Quotas, an asynchronous rate limiting system. Client services use a lightweight SDK and middleware to read rate limiting decisions from local in-memory caches and stream usage metrics asynchronously via Apache Kafka. The Quotas service aggregates usage data locally, flushes stats to Redis periodically, and publishes updated rate limiting decisions back over Kafka topics. In production, Quotas successfully handles 200k peak transactions per second with decision enforcement delays capped at 200 milliseconds.

  Jim Zhan

• Grab · Mar 27, 2019

  Designing Resilient Systems Beyond Retries (Part 3): Architecture Patterns and Chaos Engineering

  Building resilient systems requires architectural safeguards and proactive testing beyond basic retries and circuit breakers. Architectural patterns such as idempotency keys enable safe retries without creating inconsistent state during failures. Asynchronous responses and deferrable work isolate services from downstream dependency latency and errors, though they can conflict with the fail-fast principle. To validate system behavior under stress, chaos engineering introduces intentional failures in production to test hypotheses against a defined steady state. Selectively adopting complementary patterns reduces failure points while avoiding unnecessary architectural complexity.

  Michael Cartmell

• Grab · Jan 8, 2019

  Designing Resilient Systems: Circuit Breakers or Retries? (Part 2)

  Retries enable software systems to recover from transient upstream failures by automatically repeating unsuccessful requests. While retrying increases the chance of request completion across multi-host setups, it consumes additional CPU and time without inherently tracking host health. Applications must selectively retry errors with a likelihood of success, such as 500 and 503 status codes, while avoiding client-side failures like 400 or 401. To manage distributed systems safely, retries require idempotent operations or cryptographic nonces, along with backoff and jitter to prevent request stampedes. Tuning retry counts, timeouts, and delays is critical to cap the worst-case consumer response time.

  Corey Scott