Home / System Design / Concepts / CDN (Content Delivery Network) Concepts
CONCEPT SHEET · Concepts
CDN (Content Delivery Network)
One-liner: Globally distributed edge caches that serve static (and some dynamic) content near users, cutting latency and origin load.
Article Concepts © Arthur Bernier Jr 517 words 1 code block
Say this#
SAY THIS
Edge / PoP (point of presence) — the cache servers near users.
Origin — your server or bucket the CDN fetches from on a miss.
Origin shield / mid-tier cache — a regional cache layer so many edges don't all hit origin.
Pull CDN — edge fetches from origin on first request (lazy). Default for most.
Push CDN — you upload content to the CDN ahead of time.
TTL / Cache-Control / max-age / s-maxage — how long the edge may serve without revalidating.
ETag / If-None-Match → 304 — conditional revalidation.
Cache key — URL + selected headers/query/cookies; normalize it.
Cache busting / fingerprinting — app.3f9a1c.js with immutable, long TTL.
Purge / invalidation — explicit removal; slow and limited; prefer versioned URLs.
Anycast — same IP advertised from many PoPs; BGP routes to nearest.
Signed URLs / signed cookies — private content via CDN.
Examples — Cloudflare, CloudFront, Akamai, Fastly, Google Cloud CDN.
How it works#
TEXT Copy
user -> DNS (geo/anycast) -> nearest edge PoP --hit--> response |--miss--> origin shield --miss--> origin (S3 / app)
DNS or anycast routes the user to the nearest PoP.
Edge checks its cache by cache key; hit returns in single-digit ms.
Miss goes to shield, then origin; response cached per Cache-Control.
Deploys ship new fingerprinted asset names; HTML stays short-TTL or no-store.
Dynamic content: CDN still terminates TLS near the user and keeps warm connections to origin (reduces TCP/TLS handshake RTTs); can run edge compute (Cloudflare Workers, Lambda@Edge).
Trade-offs#
Choice Pro Con Pull CDN Zero upload step, caches only what's requested First request per PoP is a miss Push CDN Always warm, predictable Must manage uploads/expiry; wasted space Long TTL + fingerprinting Near-100% hit ratio, no purges Requires build pipeline discipline Short TTL on HTML Fast rollouts More origin traffic Caching personalized responses Possible with Vary/edge logic Easy to leak one user's data to another; usually don't
Numbers#
Edge hit latency: ~1-10 ms vs ~50-150 ms cross-continent to origin.
Static asset hit ratios of 90-99% are typical when fingerprinted.
Cloudflare and Akamai each operate PoPs in 300+ cities; CloudFront 600+ PoPs (order of magnitude: hundreds).
Purge propagation: seconds to minutes; CloudFront invalidations are billed beyond a free monthly quota.
In the interview#
SAY THIS
Draw it for anything with static assets, images, video, or global users: "CDN in front, S3 as origin, long TTL on fingerprinted assets."
Say: "Cache key is URL only for static; HTML is short-TTL; private media via signed URLs."
Follow-up: "How do you invalidate?" → "Don't: version the URL. Purge only for emergencies."
Follow-up: "Does a CDN help dynamic API calls?" → "Yes: TLS termination near the user, connection reuse to origin, DDoS/WAF at the edge, and micro-caching of hot GETs for a few seconds."
Creator
Written by Arthur Bernier Jr (Big Poppa Code). Arthur Bernier Jr — Big Poppa Code — is a software engineer, educator and entrepreneur: a former CTO at VC-backed startups and engineering lead at a billion-dollar company, mentor to 800+ engineers, now Senior Director of AI, Computer Programming and Cloud Computing at Per Scholas, and the host of the Deeper Than Code podcast. Everything on this page is his original teaching material.
bigpoppacode.io
License © Arthur Bernier Jr all rights reserved