--- title: Worker Backpressure (Part 1) | daily.dev description: Canva built a mechanism called Worker Backpressure into its internal queue library so worker components automatically slow down when a dependency starts... canonical: https://daily.dev/posts/worker-backpressure-part-1--cxqrqmk9u twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Worker Backpressure (Part 1) | daily.dev og:description: Canva built a mechanism called Worker Backpressure into its internal queue library so worker components automatically slow down when a dependency starts... og:url: https://daily.dev/posts/worker-backpressure-part-1--cxqrqmk9u og:image: https://api.daily.dev/og/posts/CXQRQmk9u.png og:image:alt: Worker Backpressure (Part 1) og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Worker Backpressure (Part 1) **[Canva Engineering](https://daily.dev/sources/canva)** · 12 min read · 2 upvotes · 0 comments ## Summary Canva built a mechanism called Worker Backpressure into its internal queue library so worker components automatically slow down when a dependency starts failing and speed back up once it recovers, without human intervention. The system tracks per-message success/failure outcomes, feeds them into a pluggable controller that maintains a backoff factor between 0.0 and 1.0 against a configured failure-rate set point, and scales how many messages a worker pulls concurrently. It compares favorably to prior approaches (manual scaling, fixed rate limits, circuit breakers, exponential backoff, adaptive backoff) because it runs entirely locally with near-zero runtime cost and no external coordinator. Two real production incidents are detailed: a ~4-hour multi-spike cloud outage where the DLQ grew by just one message instead of thousands, and a 32.5-hour sustained overload against a throughput quota where only 22 of 1.8 million failed attempts reached the DLQ. Trade-offs include a throughput cost during backoff and reliance on a single success/failure signal, with plans to add richer signals like latency in future iterations. A follow-up post will cover the controller's internal algorithm and tuning knobs. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How does Canva's Worker Backpressure mechanism decide how many messages a queue worker can process at once? A pluggable backpressure controller tracks each processed message's success or failure outcome and maintains a backoff factor from 0.0 (full speed) to 1.0 (fully backed off), measured against a configured set point representing an acceptable background failure rate. Before each poll, the worker asks the controller how many messages it may pull, and the controller scales that number down proportionally to the current backoff factor, all computed locally with no network calls. _daily.dev surfaces engineering deep dives like this for teams designing their own queue resilience mechanisms._ ### How effective was adaptive backoff at preventing dead letter queue growth during a real cloud provider outage at Canva? During a roughly 4-hour multi-spike cloud-provider outage, the dead letter queue grew by only a single message despite individual worker instances briefly spiking as high as 50% failure rate. Out of 1,610,173 successful calls and 498 errors, the fleet-wide failure rate peaked at just 1.42%, versus the thousands of failed messages such an outage would normally produce without the backoff mechanism. _Engineers hardening async workflows against dependency outages can track real-world resilience patterns on daily.dev._ ### What alternatives to adaptive backoff controllers were considered for throttling queue workers under dependency failure? Manually scaling the worker fleet, fixed rate limiting inside processing logic, circuit breakers, and exponential backoff on retries were all tried but found lacking. Circuit breakers offer no gradual ramp between full speed and full stop and can flood a recovering dependency; fixed rate limits go stale as capacity changes; exponential backoff operates per-message and doesn't regulate a worker's overall load on a dependency. _Teams weighing circuit breakers against adaptive throttling can compare real trade-offs on daily.dev._ --- Tags: [#distributed-systems](https://daily.dev/tags/distributed-systems) [View this post on daily.dev](https://daily.dev/posts/worker-backpressure-part-1--cxqrqmk9u) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Worker Backpressure (Part 1)","url":"https://daily.dev/posts/worker-backpressure-part-1--cxqrqmk9u","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/worker-backpressure-part-1--cxqrqmk9u"},"datePublished":"2026-09-17T05:32:18.946Z","dateModified":"2026-09-17T05:32:45.018Z","description":"Canva built a mechanism called Worker Backpressure into its internal queue library so worker components automatically slow down when a dependency starts...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/7943254bed0e69de7ae0fad8826ea3ca?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/7943254bed0e69de7ae0fad8826ea3ca?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Canva Engineering","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Canva Engineering","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/e6cd212c478341ed93323659665a923a","url":"https://daily.dev/sources/canva"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/worker-backpressure-part-1--cxqrqmk9u","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":2},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"distributed-systems","timeRequired":"PT12M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Canva Engineering","item":"https://daily.dev/sources/canva"},{"@type":"ListItem","position":3,"name":"Worker Backpressure (Part 1)"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/worker-backpressure-part-1--cxqrqmk9u#faq","mainEntity":[{"@type":"Question","name":"How does Canva's Worker Backpressure mechanism decide how many messages a queue worker can process at once?","acceptedAnswer":{"@type":"Answer","text":"A pluggable backpressure controller tracks each processed message's success or failure outcome and maintains a backoff factor from 0.0 (full speed) to 1.0 (fully backed off), measured against a configured set point representing an acceptable background failure rate. Before each poll, the worker asks the controller how many messages it may pull, and the controller scales that number down proportionally to the current backoff factor, all computed locally with no network calls. daily.dev surfaces engineering deep dives like this for teams designing their own queue resilience mechanisms."}},{"@type":"Question","name":"How effective was adaptive backoff at preventing dead letter queue growth during a real cloud provider outage at Canva?","acceptedAnswer":{"@type":"Answer","text":"During a roughly 4-hour multi-spike cloud-provider outage, the dead letter queue grew by only a single message despite individual worker instances briefly spiking as high as 50% failure rate. Out of 1,610,173 successful calls and 498 errors, the fleet-wide failure rate peaked at just 1.42%, versus the thousands of failed messages such an outage would normally produce without the backoff mechanism. Engineers hardening async workflows against dependency outages can track real-world resilience patterns on daily.dev."}},{"@type":"Question","name":"What alternatives to adaptive backoff controllers were considered for throttling queue workers under dependency failure?","acceptedAnswer":{"@type":"Answer","text":"Manually scaling the worker fleet, fixed rate limiting inside processing logic, circuit breakers, and exponential backoff on retries were all tried but found lacking. Circuit breakers offer no gradual ramp between full speed and full stop and can flood a recovering dependency; fixed rate limits go stale as capacity changes; exponential backoff operates per-message and doesn't regulate a worker's overall load on a dependency. Teams weighing circuit breakers against adaptive throttling can compare real trade-offs on daily.dev."}}]} ```