Design a Hotel Reservation System

The ask

A guest searches a place and dates, picks a room and pays. The booking is a promise for set nights at a set hotel.

A room night is one room for one night. Inventory lives per hotel, per room type and per night.

Overbooking is accepting a few more bookings than rooms, on purpose, because some guests cancel or never arrive. The practice is capped and planned, never open-ended.

A hold gives one guest time to pay. While a room is held, no other guest can book it.

Estimate the scale

The design covers 100,000 hotels with 100 rooms each.

100,000 x 100 = 10,000,000 rooms in total.

Searches run at 100,000,000 a day. 100,000,000 / 86,400 = 1,157 searches per second.

Bookings run at 1,000,000 a day. 1,000,000 / 86,400 = 12 bookings per second.

Searches dwarf bookings. 100,000,000 / 1,000,000 = 100 searches for each booking.

API and data

The operations are search rooms, hold a room, confirm a booking, cancel a booking and read a booking.

A search carries a place, check-in and check-out dates, and a guest count. Results show price and room facts for the whole stay.

A hold carries the hotel, the room type, the nights and a guest reference. A room is held for 10 minutes while payment completes.

A booking record stores the guest, the hotel, the room type, the nights, the price and a state. States run from held to booked to cancelled or completed.

Prices are stored per room type per night. A stay price is built from the nights the guest picks.

High-level design

Search reads from a search index and an availability store built for reads. Shoppers never touch the booking store on a search.

A booking service owns holds and bookings. It is the only writer for room night inventory.

The payment system takes payment after a hold. A confirmed payment turns a hold into a booking.

Availability updates flow from the booking service to the search side through a queue. Search stays fast and slightly behind the truth.

The hold step checks the booking store directly. Display can lag, and the promise cannot.

Deep dive: the same room night

Two guests can pick the last room for the same night at the same moment. Both searches showed it as free.

The booking service grants one hold per room night as one guarded step. The check and the hold are written together.

Inventory is partitioned by hotel and night. One hotel night has one writer path, so the race has one judge.

The losing guest gets a fast, honest answer and other room types. A sold-out room night never becomes a booking.

When the winning hold expires unpaid, the room night frees. The next hold in line can take it.

Deep dive: overbooking with care

Empty rooms earn nothing, and some booked guests never arrive. A capped extra booking count fills part of that gap.

The cap is set per hotel and per night from past cancellation patterns. A busy holiday night gets a tighter cap than a quiet night.

Holds still respect the cap. The booking service counts bookings plus the cap, and no path can pass it.

When every guest does arrive, the hotel moves the extra guest to a partner hotel of equal or better standing. The move, transport and price gap are the hotel cost, stated in advance.

The clash rate is tracked per hotel. A hotel that clashes often has its cap cut.

Search at scale

Searches near a city draw on a geospatial index over hotel locations. The index narrows hotels before prices and availability are checked.

Popular place and date pairs are cached. A cache answer carries a short life because availability moves.

Filters for price, size and features run on the search index. Only a pick reaches the booking service.

Photos ride blob storage and a CDN. Text search stays light while pages still look rich.

Failures and retries

A payment timeout leaves a hold in doubt. The hold state and the payment reference let the guest ask for the stored result.

A retry of a booking confirm uses the same reference. One payment can never create two bookings.

A cancellation frees every night of the stay in one step. A partial free would strand single nights that cannot sell.

If the booking service fails, holds pause and search can show rooms with a warning. A promise is never made blind.

Evaluation and trade-offs

A separate search side buys speed. Its cost is stale display, repaid by a truthful hold step.

Overbooking buys fuller hotels. Its cost is a rare moved guest, carried by the hotel under a stated plan.

One writer per hotel night buys certainty. A giant hotel at a peak moment feels that limit first.

The design keeps the guest promise at the centre. A room shown can be wrong, and a room booked cannot.

Scale at a glance