Backend Engineer Roadmap
A clear path from HTTP to production APIs and services. This guide maps what to learn, where it already lives in this repo, what is still thin, and free resources you can use today.
Who this is for: learners who want backend engineering as a first-class skill, not only as a side effect of ML or full-stack study.
How this repo splits backend content today
| Layer | Where | What you get |
|---|---|---|
| Architecture vocabulary | System Design for Beginners | HTTP, caching, load balancing, CAP, queues, sharding |
| Hands-on Node/Postgres | Full-Stack Track Phases B, C, E | Express, SQL, layering, webhooks, observability |
| ML serving context | Module 13, ML System Design Guide | FastAPI, model APIs, ML service design |
| This guide | You are here | Reading order, gaps, portfolio milestones, free links |
Pair this roadmap with the in-repo tracks above. Do not read system design and Node lessons as competing paths. They stack.
Table of Contents
- Phase 0: Orientation
- Phase 1: The request path
- Phase 2: API contracts and identity
- Phase 3: Data and search
- Phase 4: Speed, async, and decoupling
- Phase 5: Reliability and operations
- Phase 6: Security
- Phase 7: Scale and concurrency
- Expert gaps we added
- Portfolio milestones
- Free resource library
- Try next
Phase 0: Orientation
Read this phase once before you touch frameworks.
1. How this roadmap is organized
Goal: See the full journey before you optimize for tools.
Order in this guide: Phase 0 → 7. Each phase ends with a small deliverable. Skip nothing in Phase 1–3 even if you already know Express or Django.
In-repo: System Design README (side track overview), Full-Stack AI Blueprint Phases B–E (implementation track).
Free resources
- The Twelve-Factor App (how production services are organized)
- Backend Developer Roadmap (roadmap.sh) (visual checklist)
2. Walk the path of a true backend engineer
Goal: Know what “good” looks like at junior, mid, and senior levels.
| Level | You can… |
|---|---|
| Junior | Build CRUD APIs, write SQL, handle auth basics, deploy one service |
| Mid | Design REST contracts, tune queries, add caching and queues, ship observability |
| Senior | Reason about consistency, failure modes, scaling bottlenecks, and security tradeoffs |
In-repo: Career Roadmap Guide (role slice in this repo).
Free resources
3. What is a backend, how do they work, and why do we need them?
Goal: Separate client, API/service, data store, and async workers in your mental model.
A backend accepts requests, enforces rules, reads and writes durable state, and returns responses. It hides data layout, business rules, and integration with third parties from the client.
In-repo: Application Architecture, Phase B Lesson 1.
Free resources
4. Why learn the request path before frameworks
Goal: Resist tutorial-driven learning that skips the request lifecycle.
Strong backend work means you can debug any stack: you know where routing, validation, auth, and persistence sit even when the framework magic breaks.
Why it matters for ML learners: model serving is still a backend problem (latency, batching, auth, observability). See Module 13.
Free resources
- HTTP: The Definitive Guide (O'Reilly sample chapters) (conceptual reference)
Phase 1: The request path
Everything in backend engineering hangs off one question: what happens between socket open and response sent?
5. Understanding HTTP for backend engineers
Goal: Methods, status codes, headers, cookies, content negotiation, keep-alive, and HTTP/2 basics.
In-repo (strong): HTTP, Networking basics, Phase B.
Free resources
- MDN HTTP overview
- HTTP Status Codes (httpstatuses.com)
- curl manual (practice requests without Postman)
6. Routing: how requests find their handler
Goal: Path params, query strings, route tables, middleware order, and 404 vs 405 semantics.
In-repo (strong): Phase B Lesson 4, Flask web development (Python alternative).
Free resources
7. Serialization and deserialization
Goal: JSON as the default wire format, schema validation, date/decimal pitfalls, and versioning of payloads.
Gap in repo: ML guides cover model serialization (pickle, ONNX). This phase is about request/response bodies.
Practice: Accept JSON, validate with a schema library, return typed errors on bad input.
In-repo (partial): Phase B, Phase D validation, API Design.
Free resources
- JSON Schema tutorial
- Zod documentation (TypeScript) or Pydantic (Python)
Phase 2: API contracts and identity
8. Authentication and authorization
Goal: Sessions vs JWT, refresh tokens, RBAC, OAuth2/OIDC at a practical level, and “authn vs authz.”
In-repo (strong): Phase B Lesson 5, Full-Stack Blueprint Modules 08–09, API Design auth section.
Free resources
9. Validations and transformations
Goal: Validate at the boundary, transform for the domain layer, never trust the client.
Patterns: DTO in → domain model → DTO out. Reject early with stable error shapes.
In-repo (moderate): Phase B, Phase D.
Free resources
10. Controllers, services, repositories, middleware, and request context
Goal: One direction of dependency: route → controller → service → repository → database. Middleware for cross-cutting concerns. Request context for user id, trace id, and locale.
In-repo (moderate): Phase E Lesson 1. Repository pattern is named here as a gap to practice explicitly.
Free resources
- Martin Fowler: Patterns of Enterprise Application Architecture (online catalog)
- NestJS docs (layering example) even if you use Express
11. Complete REST API design
Goal: Resources, nouns not verbs, idempotent methods, pagination, filtering, error format, and OpenAPI contracts.
In-repo (strong): API Paradigms, API Design, Phase B portfolio builds.
Free resources
- Microsoft REST API design guidelines
- OpenAPI Specification
- JSON:API specification (one opinionated standard)
Phase 3: Data and search
12. Mastering databases with Postgres
Goal: Schema design, indexes, transactions, isolation levels, migrations, connection pooling, and EXPLAIN for slow queries.
In-repo (strong): Phase C, Module 19, SQL in system design.
Free resources
- PostgreSQL Tutorial
- Use The Index, Luke (indexing and SQL performance)
- PgBouncer docs (connection pooling)
15. Full text search (Elasticsearch and alternatives)
Goal: Inverted indexes, analyzers, relevance scoring, and when to use Postgres tsvector vs Elasticsearch vs OpenSearch.
Gap in repo: Design problems mention search. No dedicated Elasticsearch lesson yet. Phase H covers pgvector for semantic search, which complements but does not replace keyword search.
Free resources
Phase 4: Speed, async, and decoupling
13. Caching
Goal: Cache-aside, write-through, TTL strategy, cache invalidation, and CDN vs application cache vs database cache.
In-repo (strong): Caching, CDNs.
Free resources
14. Task queues and background jobs
Goal: Why async work exists, at-least-once delivery, retries, dead-letter queues, and worker scaling.
In-repo (moderate): Message Queues, Phase E Lesson 3.
Free resources
- Celery documentation (Python)
- BullMQ documentation (Node)
- RabbitMQ tutorials
Phase 5: Reliability and operations
16. Error handling and fault-tolerant systems
Goal: Stable error envelopes, retries with backoff, circuit breakers, timeouts, bulkheads, and idempotency keys.
In-repo (moderate): Phase B error handling, Phase E idempotency, API Design errors.
Free resources
17. Production-grade configuration management
Goal: Environment separation, secrets vs config, feature flags, and config validation at startup.
Gap in repo: .env appears in Phase B/G. This phase adds hierarchy: defaults → env → secrets manager.
In-repo (partial): Phase G env, Phase B Lesson 2.
Free resources
18. Logging, monitoring, and observability
Goal: Structured logs, metrics (RED/USE), traces, correlation ids, and alerting that pages humans for symptoms not causes.
In-repo (moderate): Phase E Lesson 5, Application Architecture.
Free resources
19. Graceful shutdown
Goal: Stop accepting new work, drain in-flight requests, flush buffers, close DB pools, and respect Kubernetes termination grace.
Gap in repo: Not covered yet. Treat as a required production checklist item.
Practice: Handle SIGTERM, expose /health and /ready, set server keepAliveTimeout below load balancer idle timeout.
Free resources
Phase 6: Security
20. Backend security: everything you need to know
Goal: OWASP API Top 10, injection, SSRF, rate limiting, secrets hygiene, dependency scanning, and least-privilege DB roles.
Gap in repo: OWASP links exist in the Full-Stack blueprint. No standalone backend security guide yet. This roadmap collects the minimum bar.
In-repo (partial): Phase B auth, deployment advanced topics (cloud IAM).
Free resources
Phase 7: Scale and concurrency
21–22. Backend scaling and performance engineering
Goal: Vertical vs horizontal scale, load balancers, read replicas, sharding intro, backpressure, and profiling before guessing.
In-repo (strong): Proxies and load balancing, Replication and sharding, Consistent hashing, CAP theorem, Phase G Nginx.
Free resources
23. Concurrency and parallelism: IO bound vs CPU bound
Goal: Event loop for IO, thread/process pools for CPU, when to offload to workers, and why blocking the event loop hurts Node.
Gap in repo: Phase B mentions the event loop. This phase needs explicit IO vs CPU framing.
In-repo (partial): Phase B Lesson 2, Computer Architecture.
Free resources
Expert gaps we added
These topics rarely appear in beginner playlists but separate production engineers from tutorial graduates.
| Topic | Why it matters | In-repo touchpoint |
|---|---|---|
| Health checks (liveness/readiness) | Orchestrators need to know when to route traffic | Phase G, Module 13 deployment |
| Idempotency keys | Safe retries on payments and writes | Phase E Lesson 2 |
| Rate limiting and backpressure | Protect dependencies under load | Design a Rate Limiter |
| Database migrations | Schema evolution without downtime fear | Phase C, Phase D Prisma |
| OpenAPI / contract testing | Clients and servers stay in sync | API Design |
| Distributed tracing | Debug latency across services | Phase E observability |
| Outbox / transactional messaging | Reliable events without dual-write bugs | Message Queues |
| Webhooks | Inbound async integration | Phase E Lesson 2 |
| CI/CD for APIs | Ship small, ship often, roll back safely | Phase G, Docker Tutorial |
| Backup and restore drills | Postgres is only durable if you test recovery | Phase C, Module 19 |
Portfolio milestones
Build these in order. Each proves a slice of the roadmap.
| Milestone | Proves | Suggested stack |
|---|---|---|
| M1: Raw HTTP API | Routing, JSON, status codes | Node http or Python FastAPI |
| M2: Auth + Postgres CRUD | Validation, SQL, migrations | Express + Postgres or FastAPI + SQLAlchemy |
| M3: Cache + queue | Redis cache-aside, background worker | BullMQ/Celery + Redis |
| M4: Search | Full text or semantic search | Elasticsearch or Postgres FTS + pgvector |
| M5: Production slice | Logs, metrics, graceful shutdown, Docker | OpenTelemetry + Compose + health routes |
Show M3–M5 in README with architecture diagram, env sample, and one curl example per endpoint.
Free resource library
Curated links grouped by phase. All free at time of writing.
Core references
HTTP, APIs, and design
Postgres and data
Caching, queues, search
Security and reliability
Node and Python (pick one primary stack)
Try next
- Read System Design: HTTP and Phase B in parallel this week.
- Build M1 without Express first, then rebuild with middleware and validation.
- Skim Career Roadmap: Backend Engineer and pick modules 19 and 13 when you reach data and ML serving.