Databases
Relational vs document, wide-column, graph, and key-value
A startup adopts MongoDB because “relational schemas are rigid.” Three years later, ad-hoc joins are impossible, data integrity is application-enforced (inconsistently), and the team is migrating to Postgres. The rigidity they wanted to avoid was the discipline that would have saved them.
The trade-off space
The relational model is one data model among several. Senior engineers know where each alternative wins — and where the default “just use Postgres” beats “chose the specialised tool.”
Document stores (MongoDB, Firestore, DynamoDB). Win when documents are accessed as units and never joined. A single document contains all the data for one entity (a product with nested variants, media, and attributes). No cross-document integrity needed. The query pattern is “fetch this document by key” or “filter by top-level fields.” Lose when you need ad-hoc queries, JOIN-equivalent operations, or referential integrity across documents.
Wide-column stores (Cassandra, ScyllaDB). Win for very high write throughput (~100k+ writes/second) with predetermined query patterns that do not change after schema design. Cassandra’s primary key includes the partition key (how data is distributed) and the clustering key (how data is sorted within a partition) — queries that match the partition key are fast; any other query is a full scan. Lose when query patterns evolve or you need aggregation.
Graph databases (Neo4j, Dgraph, Amazon Neptune). Win when graph traversal is the dominant query: “find all friends of friends within 3 hops,” “detect circular payment paths,” “find shortest path in a knowledge graph.” Lose for everything else. SQL recursive CTEs can substitute for many graph queries at small scale; at large scale or if traversal is the primary workload, a native graph DB is cheaper.
Key-value stores (Redis, DynamoDB in KV mode). Win for pure point lookups by a known key — session storage, caches, feature flags, short-lived counters. Lose for anything requiring range queries, aggregation, or relationship traversal.
| Model | Wins when | Loses when | Examples |
|---|---|---|---|
| Relational | Recurring schema, ad-hoc queries, cross-type integrity | Pure document access, known-key-only workloads at extreme scale | Postgres, MySQL |
| Document | Heterogeneous per-row schema, document-unit access | Ad-hoc queries, integrity across documents | MongoDB, Firestore |
| Wide-column | Very high write throughput, fixed query patterns | Evolving queries, aggregation | Cassandra, ScyllaDB |
| Graph | Deep traversal as the primary query | Everything else | Neo4j, Amazon Neptune |
| Key-value | Pure point lookup by known key | Range queries, aggregation, relationships | Redis, DynamoDB (KV mode) |
Postgres is not just relational
Postgres’s self-description is “the world’s most advanced open source relational database.” In practice, the extension ecosystem covers most workloads you might take to a specialist store:
- JSONB + GIN indexes — document-like queries without a document store.
- pg_vector — vector similarity search (nearest-neighbour for AI embeddings), replaces purpose-built vector databases for most workloads.
- PostGIS — full geospatial engine (spatial indexes, geo-operators), replaces specialist geo stores.
- TimescaleDB — time-series partitioning and compression, replaces InfluxDB for many workloads.
- pgcrypto — encryption, hashing, UUIDs from a cryptographic source.
- Recursive CTEs — limited graph traversal without a graph database.
The question “do I need a specialist store?” becomes: “does my workload specifically exceed what Postgres + the right extension can do?” For most teams under ~10 TB and without extreme write-throughput requirements, the answer is no.
Postgres vs MySQL: schema-design defaults that matter
Both are relational; both implement most of SQL:2011. The differences that matter at schema design time:
NULL behaviour in UNIQUE constraints. SQL standard (and Postgres) allows multiple NULLs in a UNIQUE column (NULL is not equal to anything, including another NULL). MySQL’s InnoDB also allows multiple NULLs. But MySQL historically (before 8.0) had different NULL behaviour in some operations. Use Postgres UNIQUE NULLS NOT DISTINCT (SQL:2023) if you want to prevent duplicate NULLs.
Implicit type coercion. MySQL is more forgiving — silently coerces '42' to 42, truncates strings that exceed VARCHAR length instead of erroring. Postgres is strict — wrong types error explicitly. The Postgres behaviour catches schema mismatches earlier.
Default storage engine. MySQL defaults to InnoDB; older tooling sometimes uses MyISAM (no transactions, no FK support). In 2026, all MySQL production use should be InnoDB. Postgres has one storage engine with no footgun to fall into.
Ecosystem. Postgres: PostGIS, TimescaleDB, pg_vector, pgcrypto, citus, pgroll. MySQL ecosystem: Vitess (horizontal scaling), PlanetScale (MySQL-as-a-service), Aurora MySQL (AWS). Pick MySQL if you are deep in the MySQL horizontal-scaling ecosystem (Vitess, PlanetScale, Aurora MySQL); otherwise Postgres for greenfield work.
Multi-tenant schema design: a worked decision
The hardest schema decision for B2B SaaS is tenant isolation. Three patterns:
Schema-per-tenant. Each workspace gets its own Postgres schema. Complete DDL isolation. Migrations are run per-schema (n schemas × 1 migration = n operations). Works up to ~1000 tenants; above that, connection overhead and migration complexity grow linearly. Tenant switching is clean (SET search_path).
Database-per-tenant. Ultimate isolation. Prohibitively complex above ~100 tenants. Works for enterprise SaaS with per-contract isolation requirements.
Row-level isolation (workspace_id column + RLS). One schema, all tenants in the same tables. Every tenanted table has workspace_id BIGINT NOT NULL. Postgres Row-Level Security (RLS) policies filter rows based on a session-level GUC:
ALTER TABLE projects ENABLE ROW LEVEL SECURITY;
CREATE POLICY projects_tenant_isolation ON projects
USING (workspace_id = current_setting('app.current_workspace_id')::BIGINT);The application connection sets SET app.current_workspace_id = X after authentication. RLS enforces that every query on that connection only sees rows for workspace X. A missed WHERE in application code is caught by RLS.
Defence-in-depth: RLS + a CI lint that requires workspace_id in every WHERE clause. The linter catches bugs before production; RLS is the safety net.
Why this works
Why add a CI lint if RLS already enforces isolation? RLS is a guarantee, not an error message. A query that violates RLS silently returns zero rows (or errors if configured as RESTRICTIVE). The developer sees “no results” and assumes the data does not exist. The CI lint fails the build when a query touches a tenanted table without workspace_id, giving an actionable error before the query ever hits production.
A new social feature needs 'find all friends of friends within 2 hops' for a recommendation engine. The users table has 10M rows and 50M follow relationships. Pick the query approach.
A team at 200 B2B customers considers schema-per-tenant isolation. At what scale does this pattern become operationally expensive and why?
Postgres Row-Level Security is enabled and a policy restricts rows to `workspace_id = current_setting('app.current_workspace_id')`. An application query accidentally omits the WHERE workspace_id clause. What happens?
- 01Articulate why the relational model wins over document, wide-column, graph, and key-value alternatives for most B2B SaaS workloads, and give one specific winning condition for each alternative.
- 02What are the three multi-tenant isolation patterns for Postgres, and when does each apply?
- 03Name two schema-design-relevant differences between Postgres and MySQL defaults.
The relational model wins for recurring-structure, ad-hoc-query, integrity-critical workloads — most B2B SaaS, fintech, ops tooling. Document stores win for document-unit access with no cross-document integrity. Wide-column wins at extreme write throughput with fixed queries. Graph wins when traversal is the primary query. Key-value wins for pure point lookups. Postgres with extensions (JSONB, pg_vector, PostGIS, TimescaleDB) covers most specialist needs in a single engine. For multi-tenant SaaS: row-level isolation with RLS is the default; schema-per-tenant for contractual isolation up to ~1000 tenants; database-per-tenant for enterprise contracts. Postgres vs MySQL: Postgres is stricter (type errors, NULL semantics) and has the richer extension ecosystem; choose MySQL only for specific ecosystem or sharding needs.
appears again in140
- Why GraphQL gets N+1junior
- DataLoader mechanics: tick-boundary batchingmiddle
- Batch function contracts: ordering, shapes, errorsmiddle
- Federation and lookahead: batching beyond DataLoadermiddle
- Query complexity defences: depth, cost, persisted queriesmiddle
- Senior GraphQL API: scheduling contract, tenant isolation, observabilitysenior
- Why idempotency: making retries safejunior
- Server-side state machine: four states of an idempotency keymiddle
- Outbox and inbox: effectively-once across the dual-write boundarymiddle
- Concurrency and cache architecture for idempotency at scalesenior
- Observability, production failures, and global-scale designsenior
- The event loop: one thread, three queuesjunior
- Tasks, microtasks, and scheduler.yield()middle
- Microtask starvation, Long Tasks, and LoAFsenior
- Node.js event loop: phases, nextTick, and loop lagsenior
- React, Vue, and INP observability in productionsenior
- The render pipeline: six stages from bytes to pixelsjunior
- Stage costs and the renderer process modelmiddle
- Invalidation, dirty bits, and containmiddle
- Compositor layers: promotion, overlap, and GPU memorymiddle
- DevTools flame strip and the frame lifecyclemiddle
- Layout thrash: forced synchronous layoutsenior
- BeginMainFrame, compositor-driven animations, and GPU memorysenior
- Production observability: LoAF, INP, and the full attack surfacesenior
- What V8 is and why performance varies 100×junior
- V8''''s four-tier JIT pipeline and profile-guided tieringmiddle
- Hidden classes, transition trees, and memory layoutmiddle
- Inline caches, IC states, and deoptimizationmiddle
- Orinoco GC: parallel scavenger, concurrent marking, and write barriersmiddle
- TurboFan''''s speculative engine and the deopt-loop trapsenior
- V8 in production: isolates, pointer compression, and real failuressenior
- Service worker lifecycle and cache strategiesmiddle
- Service worker edge cases: version skew, durability, and navigation trapssenior
- What the reconciler does: render vs commitjunior
- The fiber object and the double-buffer treemiddle
- Render phase purity and commit phase sub-stepsmiddle
- Reconciliation: diffing heuristics and the key trapmiddle
- Priority lanes, time-slicing, and useTransitionmiddle
- Bailout, memoisation, and tearingsenior
- React Profiler, the Compiler, and production observabilitysenior
- Rendering strategies: SSG, SSR, ISR, streaming, and hydrationjunior
- SSG, SSR, ISR, streaming, and RSC — how each worksmiddle
- Hydration cost: selective, progressive, islands, resumabilitymiddle
- Hydration mismatch: causes, detection, and the determinism rulesenior
- RSC, per-route strategy, and production observabilitysenior
- Core Web Vitals: what LCP, INP, and CLS measurejunior
- CLS: why layout shifts happen and how to stop themmiddle
- Metric tradeoffs, RUM attribution, and the CI+field loopsenior
- The full picture: URL to LCP to INP as a relay racejunior
- Eight layers traced: from the service worker to the second navigationmiddle
- Five canonical breaks: where production reliably diessenior
- The three-track method: reading traces and building a monitored systemsenior
- What is a cache stampede and why it makes things worsejunior
- Lock and single-flight: bounding concurrent rebuildsmiddle
- XFetch: coordination-free probabilistic early expirationmiddle
- Stale-while-revalidate and CDN request coalescingmiddle
- Detecting stampedes and designing TTL for productionmiddle
- Metastable failure, fencing tokens, and production postmortemssenior
- Raft roles, terms, and why majority quorums prevent split brainjunior
- How Raft replicates a log entry and decides it is safe to commitmiddle
- Raft leader election: timeouts, voting rules, and the four safety propertiesmiddle
- Raft in the real world: partitions, slow disks, and client routingmiddle
- Raft extensions: pre-vote, learners, snapshots, and linearizable readssenior
- Raft in production: membership changes, Multi-Raft, and observabilitysenior
- Where data fetching happens — and why it decides LCPjunior
- Fetch waterfalls — diagnosis and the Promise.all curemiddle
- React Server Components and Suspense streamingmiddle
- Client-side cache: TanStack Query, SWR, and stale-while-revalidatemiddle
- LCP, prefetch, and race conditions in interactive fetchingmiddle
- Senior internals: RSC payload, caching layers, and production failure modessenior
- The three-way handshakejunior
- Sequence numbers and connection statemiddle
- DNS: what it does and why it existsjunior
- The resolver walk: referrals, record types, and gluemiddle
- TTL, caching, and DNS propagationmiddle
- The 1-RTT handshake: key shares and ECDHEmiddle
- Session resumption and 0-RTTmiddle
- WebSocket: the HTTP upgrade handshakejunior
- WebSocket frame format: opcodes, masking, fragmentationmiddle
- WebSocket backpressure: when clients can''''t keep upmiddle
- Reconnection: jittered backoff, thundering herd, message resumptionsenior
- WebSocket at scale: HTTP/2 multiplexing, permessage-deflate, C10Msenior
- WebSocket in production: proxies, security, and distributed architecturesenior
- What reverse proxies dojunior
- Health checks, connection draining, and slow startmiddle
- Session affinity, consistent hashing, and the right fixmiddle
- Retry storms, circuit breakers, and load sheddingsenior
- Resilient LB architecture: anycast, zone-aware routing, and observabilitysenior
- Why QUIC and not TCP+TLSjunior
- Connection IDs and network migrationmiddle
- 0-RTT resumption and packet encryptionsenior
- DDoS: what it is and why it worksjunior
- Amplification attacks and state exhaustionmiddle
- Rate limiting: algorithms and architecturemiddle
- WAFs, firewalls, mTLS, and HSTSmiddle
- DNS cache poisoning and BGP hijackingsenior
- Defense-in-depth architecture and attack economicssenior
- DNS, TCP, TLS in sequence: where the milliseconds gomiddle
- Proxy intercepts and security gates: rate limiters, WAF, mTLSmiddle
- Alternate paths: QUIC 0-RTT, WebSocket upgrade, connection migrationmiddle
- Observability: distributed traces, USE/RED, and samplingsenior
- Resilience: cascading retries, circuit breakers, and error budgetssenior
- What the three signals are: logs, metrics, and tracesjunior
- Why structured logs exist: the diary vs the spreadsheetjunior
- The production log schema: fields every line must carrymiddle
- PII redaction and log injectionsenior
- OTel Logs Data Model and audit logs as a subsystemsenior
- SLI, SLO, and the error budget: reliability by the numbersjunior
- Error budget policy, latency SLOs, and composite journeysmiddle
- Production SLO failures, self-observability, security, and the big picturesenior
- The incident loop: from pager to postmortem to preventionmiddle
- Cache lines, struct layout, and false sharingmiddle
- SIMD, SoA vs AoS, and memory bandwidthmiddle
- Cache-oblivious algorithms, PGO, and production failuressenior
- GC in production: observability, security, edge cases, and fleet governancesenior
- Batching: amortize fixed cost per operationjunior
- The batching window: size and wait timemiddle
- Batching in Kafka and Postgresmiddle
- io_uring and observability of batchingmiddle
- From Nagle to io_uring: evolution of batchingmiddle
- Backpressure, failure isolation, and batch security in productionsenior
- CI enforcement and RUM: making budgets stickmiddle
- V8 JIT pipeline, HTTP priorities, and bundle securitysenior
- The performance loop: discipline, not a projectjunior
- Classify and fix: matching bottleneck families to remediesmiddle
- Observability stack and CI gates: catching regressions before they shipmiddle
- Incident to enforcement: SLO burn to verified fix in 35 minutesmiddle
- Culture, economics, and org-scale performancesenior
- At-most-once, at-least-once, exactly-once: the three delivery contractsjunior
- The three failure legs — where duplicates and losses actually happenmiddle
- Consumer-side dedup: the cheapest path to exactly-once processingmiddle
- Kafka exactly-once semantics: idempotent producer and transactionsmiddle
- SQS visibility timeout, DLQ, and the outbox patternmiddle
- Exactly-once in production: impossibility proof, hybrid patterns, and real incidentssenior
- What OAuth is and why passwords are not the answerjunior
- Authorization code flow with PKCEmiddle
- ID token validation and JWKS cache managementmiddle
- Refresh token rotation and scope-based least privilegemiddle
- Sender-constrained tokens: DPoP and mTLSsenior
- OAuth in production: audience attacks, observability, and real failuressenior