01What can teams register — recurring cron jobs, one-off delayed tasks, or both?
Both: a cron expression for recurring jobs or a single run-at timestamp for one-shots, registered with a payload, an owning team, and a retry policy.
Premium preview
Job Scheduler
Design a distributed job scheduler (a cron-as-a-service system) that lets tenants register recurring and one-off jobs, guarantees each job fires close to its scheduled time, and survives worker and...
00
Practice checkpoints
The requirements are open as a taste. From the numbers onward, the full guide opens in the app.
- 01Clarify scope
- 02Requirements + scale
- 03API + data modelUnlocks in the app
- 04Draw architectureUnlocks in the app
- 05Deep diveUnlocks in the app
- 06Trade-off decisionUnlocks in the app
01
Requirements that shape the design
Do not only state requirements. Ask for them. Each card pairs the design constraint with a clarification question you can say out loud before drawing the architecture.
Functional requirements
02When a job comes due, how many workers execute it?
Exactly one worker per firing: dispatch hands out a lease with a fencing token, so even a worker that pauses and resumes cannot double-run it.
03A job execution fails — then what?
It retries with exponential backoff up to a per-job budget; after the budget is spent the run goes to a dead-letter queue and the owning team is notified.
04The scheduler was down when a job was due — run it late, skip it, or replay everything?
Per-job misfire policy chosen at registration: run-once-late, skip to the next tick, or catch up every missed run — the owner decides, because only they know if the job is idempotent.
05One team registers 100K jobs — what happens to everyone else?
Nothing: per-team concurrency quotas and priority tiers mean a team’s job storm queues behind its own cap instead of starving other teams’ workers.
06Can a team see what actually happened to their job last night?
Yes: every firing writes an execution record (due time, start, end, attempts, outcome), queryable per job — “did it run and why did it fail” is an API call, not a log dive.
Out of scopeInter-job dependency graphs (DAG workflow orchestration) · Sandboxing arbitrary user code — workers deliver firings to team-owned targets · Sub-second precision scheduling (market-data or telecom timing)
Non-functional requirements
01How close to due time must a firing land?
Within 5 seconds of the scheduled time under normal load — teams plan around that promise, so it is measured and alerted as an SLO.
02What scale are we designing for?
10 million registered jobs and roughly 116 firings per second on average, with minute-boundary spikes near 7× — the design point is the spike, not the average.
03A coordinator crashes mid-firing — what happens to that run?
No run is dropped or doubled across a crash: advancing next-run time and recording the dispatch happen in one transaction, so recovery replays or skips deterministically.
04Two coordinators both think they lead during failover?
A leader-failover overlap is bounded by the leader lease and harmless: claims are atomic conditional writes, so a doubly-scanned job still gets exactly one owner.
05What must survive a total restart?
Everything scheduled survives restart: definitions, next-run times, leases, and history live in durable storage — in-memory structures are caches, never the source of truth.
Keep asking — the interview is a conversation
Real interviews probe far more than a tidy list. These are the scope questions that separate candidates who interrogate the problem from those who recite it.
- Do our workers execute the job’s code, or do we deliver a firing signal — a webhook or a queue message — that the team’s own service executes?
- How close to the due time must a firing land — within a second, or is a few seconds fine?
- Are jobs idempotent? True exactly-once is not achievable end to end — can owners live with at-least-once plus idempotency keys?
- What is the longest a single execution can run — seconds, or multi-hour batches? That number drives the whole lease design.
- After downtime, should missed runs fire late, be skipped, or be fully replayed — and is that choice per job or global?
01
Unlock the full playbook for Job Scheduler
Numbers, architecture diagram, API and data model, deep dives, expected topics, self-check, whiteboard starter, and common mistakes unlock inside the app.
Numbers that force architecture decisions
Locked in the app
Architecture path
Locked in the app
API and data model
Locked in the app
Deep dive directions
Locked in the app
+Series