Two planes
A file storage system splits responsibility. The metadata service holds the small structured record: name, owner, size, timestamps, permissions, version, and the pointer to where the bytes live. The blob store holds the large opaque bytes. They scale on different axes.
Why separate them
- Metadata is small but hot: listings, lookups, and permission checks hammer it, so it lives in a fast indexed database.
- Bytes are large but cold per record: they belong in cheap object storage built for throughput.
- A rename or share is a metadata only change; no bytes move.
The consistency seam
The two planes can disagree. If bytes upload but the metadata write fails, you have an orphan blob. If metadata commits but the blob is missing, a read dangles. Designs make the metadata commit the source of truth and run a sweeper to reconcile orphans, so the visible state is always backed by real bytes.
Key idea
A metadata service keeps the small hot record and a pointer to the bytes, letting metadata and blobs scale separately while a sweeper reconciles their consistency seam.