CDN Architecture

A Content Delivery Network (CDN) is a globally distributed system of servers that caches and serves content from locations geographically close to end users. The fundamental insight is simple: the speed of light imposes a minimum latency proportional to physical distance. A user in Tokyo fetching data from a server in Virginia experiences at least 70ms of one-way latency due to the speed of light in fiber, plus routing overhead. A CDN PoP (Point of Presence) in Tokyo can serve the same content in under 5ms. This latency reduction compounds across the dozens of resources a modern web page requires, making CDNs one of the most impactful performance optimizations in system design.

CDN architectures use two primary models for populating edge caches. Push CDNs require the origin to upload content to the CDN proactively -- suitable for predictable content like software updates or video libraries, but operationally burdensome for dynamic websites. Pull CDNs (origin pull) are the dominant model: the edge server fetches content from the origin on the first request (cache miss), stores it, and serves subsequent requests from cache (cache hit). The cache key is typically the full URL plus selected Vary headers (e.g., Accept-Encoding, Accept-Language), determining which requests are considered equivalent. Cache hit ratio -- the percentage of requests served from cache without contacting the origin -- is the single most important CDN performance metric. Well-configured CDNs achieve 90-99% cache hit rates for static content.

Modern CDNs use a tiered cache hierarchy to balance hit rates against origin load. At the outermost layer, hundreds of edge PoPs serve users directly. Behind them, regional cache tiers aggregate traffic from nearby edges. At the center, an origin shield acts as a single point of contact with the actual origin server. When an edge misses, it queries the regional tier; if that misses, it queries the origin shield; only if the shield misses does the request reach the origin. This hierarchy ensures that even content with moderate popularity has a high probability of being cached somewhere in the hierarchy, and the origin sees dramatically reduced request volume. For example, if 100 edge PoPs all miss on the same URL simultaneously, the origin shield collapses these into a single origin fetch (request coalescing).

Cache invalidation is the hardest problem in CDN operations. TTL-based expiry (Cache-Control: max-age=3600) is simple and predictable but means stale content is served until the TTL expires. Purge APIs allow immediate invalidation of specific URLs or patterns, but global purge propagation across hundreds of PoPs takes 2-30 seconds. Versioned URLs (main.abc123.js) are the most reliable approach: deploying new content with a new filename ensures browsers and CDNs fetch the new version immediately, while old versions remain cached and valid for anyone still referencing them. Beyond caching, modern CDNs provide dynamic content acceleration through TCP optimization (larger initial congestion windows, persistent connections to origin), TLS termination at the edge (reducing handshake RTTs), DDoS mitigation, WAF (Web Application Firewall), and edge compute (Cloudflare Workers, Lambda@Edge) for running application logic at the edge.

A CDN works like a library system with a central collection (origin) and neighborhood branches (edge PoPs). When you request a book (web resource), your local branch checks its shelves (edge cache). If it has the book (cache hit), you get it immediately. If not (cache miss), the branch requests it from the regional distribution center (mid-tier cache), which might have it from a nearby branch's request. Only if nobody in the region has it does the request go to the central library (origin). Once any branch gets the book, it keeps a copy on its shelf for a set period (TTL). The most popular books are available at every branch instantly; rare books require a trip to the central library but are then stocked locally for the next reader.