Containing the Blast Radius
A cell is a complete, self contained instance of the stack: its own application servers, its own database shard, its own cache. The system runs many cells, and each user or tenant is assigned to one cell. A thin routing layer maps a request to its cell.
The goal is blast radius reduction. If a cell fails or is corrupted by a bad deploy, only the users in that cell are affected, not the whole system. The fraction of users harmed equals one over the number of cells.
Why It Beats a Big Shared Pool
In a flat sharded system, a poison query, a hot key, or a runaway bug can ripple across shared components and take everything down. Cells erect bulkheads: because cells share nothing, a failure cannot spread beyond its walls. It also bounds the impact of staged rollouts, since you deploy to one cell first.
Costs and Discipline
- Routing must be simple, reliable, and itself isolated, or it becomes a shared failure point.
- Cross cell operations are discouraged; anything spanning cells reintroduces coupling.
- Capacity is managed per cell, so cells should be sized to fit comfortably on their resources.
Cell based design trades some efficiency and the convenience of global queries for strong fault isolation at very large scale.
Key idea
Cell based architecture runs many self contained cells and pins each tenant to one, so a failure or bad deploy harms only one cell rather than the whole system.