Backend Engineering13-level learning path
Backend Engineering Roadmap
Progress from machine and Java fundamentals to secure Spring APIs, relational data, reliability, distributed-system judgment, delivery, observability, and a fictional production capstone. Published pages provide depth now; planned metadata makes the full progression visible without empty articles.
Level 0
Developer Foundations
Build the operating-system, command-line, Git, and engineering workflow knowledge that every backend task depends on.
Learning goals
- Explain what the machine and operating system do for a backend process
- Work safely from the command line and move a change through review, release, rollback, and incident learning
Prerequisites
- No backend prerequisite; basic computer use is enough
Core concepts
- CPU, memory, disk, network, processes, threads, stack, and heap
- Files, file systems, environment variables, standard input/output, permissions
- Character encoding, UTC timestamps, time zones, and the client-server model
- Linux navigation, file operations, processes, ports, logs, SSH, pipes, redirection, variables, packages, and services
- Git repository, working tree, index, commits, branches, merge, rebase, remotes, pull requests, conflicts, ignore rules, tags, and releases
- Requirements, task breakdown, implementation plans, review, testing, documentation, release, rollback, and incident learning
Hands-on labs
- Inspect processes, ports, file permissions, environment variables, logs, and Git state for a local service
Review examples, mistakes, interview prompts, and production concerns
Practical examples
- Trace a Java process from environment configuration to an open TCP port and its log output
Common mistakes
- Treating local time, process memory, or a mutable working tree as durable shared state
Interview questions
- What changes when a Java program becomes a process, and how is a thread different?
Production considerations
- Operate with least privilege, UTC at boundaries, explicit configuration, reversible releases, and useful audit history
Level 1
Java Foundations
Move from syntax and object modeling to JVM behavior and concurrency with backend-focused examples.
Learning goals
- Write clear, type-safe Java domain and service code
- Reason about collections, exceptions, memory, threads, and modern Java features in production
Prerequisites
- Level 0: processes, memory, files, command line, and Git
Core concepts
- Variables, primitives, references, operators, conditions, loops, methods, arrays, strings, enums, packages, and access modifiers
- Classes, objects, encapsulation, inheritance, polymorphism, abstraction, interfaces, composition, SOLID, and immutability
- List, Set, Map, Queue, ArrayList, LinkedList, HashMap, HashSet, TreeMap, generics, equality, and hashing
- Checked and unchecked exceptions, custom exceptions, propagation, try/catch/finally, try-with-resources, and error boundaries
- Records, sealed classes, pattern matching, lambdas, streams, Optional, method references, and java.time
- Compilation, bytecode, class loading, heap, stack, garbage collection, JIT, leaks, thread dumps, and JVM options
- Thread, Runnable, ExecutorService, Future, CompletableFuture, synchronization, locks, races, deadlocks, thread safety, and virtual threads
Hands-on labs
- Implement and test an in-memory idempotent voucher service, then inspect a thread dump
Review examples, mistakes, interview prompts, and production concerns
Practical examples
- Model a voucher redemption result with records, sealed outcomes, collections, and explicit exceptions
Common mistakes
- Using mutable shared state, inconsistent equals/hashCode, Optional fields, or parallel streams without measuring
Interview questions
- How do HashMap equality contracts, heap allocation, and thread safety affect a web service?
Production considerations
- Choose Java features for clarity; size executors and memory from workload evidence rather than defaults
Level 2
Web and HTTP
Understand the complete path from a client request to a Spring response and design predictable HTTP APIs.
Learning goals
- Trace DNS, TCP, TLS, proxy, HTTP, application, and database work
- Design REST APIs with correct method, status, caching, idempotency, and browser-security semantics
Prerequisites
- Level 0 client-server and networking basics
- Level 1 Java request/response modeling
Core concepts
- IP, DNS, ports, TCP, TLS, HTTP, proxy, reverse proxy, and load balancer
- Requests, responses, URLs, methods, status codes, headers, bodies, media types, cookies, sessions, caching, compression, and persistent connections
- Safe and idempotent methods, resource URIs, pagination, filtering, sorting, search, versioning, errors, partial updates, and documentation
- JSON objects, arrays, types, serialization, deserialization, nulls, names, timestamps, and backward compatibility
- Same-origin policy, CORS, preflight, CSRF, cookies, bearer tokens, and secure headers
Hands-on labs
- Design and exercise a paginated Task API with RFC 9457 errors and conditional requests
Review examples, mistakes, interview prompts, and production concerns
Practical examples
- Follow POST /v1/orders through DNS, HTTPS, Nginx, Spring filters, controller, service, MyBatis, PostgreSQL, and the response
Common mistakes
- Using POST for every operation, returning 200 for failures, confusing CORS with authorization, or retrying non-idempotent work blindly
Interview questions
- Which HTTP methods are safe or idempotent, and why does that matter for retries?
Production considerations
- Set explicit timeouts and limits at every hop; preserve correlation context without trusting forwarded headers blindly
Level 3
Database Engineering
Design relational data and transactions first, then use PostgreSQL and Oracle features deliberately.
Learning goals
- Model constrained relational schemas and write expressive SQL
- Diagnose plans, indexes, locks, isolation anomalies, and operational risks
Prerequisites
- Level 1 data types and equality
- Level 2 API data and concurrency expectations
Core concepts
- Tables, rows, columns, primary/foreign/unique/check constraints, nullability, relationships, normalization, and denormalization
- SELECT, INSERT, UPDATE, DELETE, WHERE, ORDER BY, GROUP BY, HAVING, joins, subqueries, CTEs, windows, and aggregates
- One-to-one, one-to-many, many-to-many, junction tables, natural/surrogate keys, audit columns, soft delete, statuses, and history
- ACID, commit, rollback, isolation, dirty/non-repeatable/phantom reads, lost updates, locks, and deadlocks
- B-tree, composite, covering/include, selectivity, plans, sequential/index scans, join strategies, offset/keyset pagination, N+1, and batching
- PostgreSQL types, JSONB, arrays, sequences, EXPLAIN ANALYZE, partial/expression indexes, full-text search, and connection limits
- Oracle sequences, identity, ROWNUM, FETCH/OFFSET, plans, indexes, date handling, and dialect differences
- Pools, migrations, backup/restore, replication basics, retention, privacy, and safe production queries
Hands-on labs
- Design users/roles and orders; tune a slow query; fix N+1; implement keyset pagination and concurrent balance updates
Review examples, mistakes, interview prompts, and production concerns
Practical examples
- Model users/roles and orders, add constraints and indexes, then compare an offset plan with keyset pagination
Common mistakes
- Adding indexes without workload evidence, relying on application-only constraints, or holding locks across external calls
Interview questions
- How would you prevent two concurrent balance updates from losing money?
Production considerations
- Test migrations and restores, bound pool size, inspect real plans, and make destructive queries reviewable and reversible
Level 4
Spring Boot Fundamentals
Build a thin-controller, service-centered Spring MVC application with explicit configuration and persistence boundaries.
Learning goals
- Explain IoC, dependency injection, beans, auto-configuration, profiles, and startup
- Place controller, service, mapper, model, validation, and exception responsibilities intentionally
Prerequisites
- Levels 1–3: Java, HTTP, SQL, and transactions
Core concepts
- IoC, dependency injection, beans, application context, component scanning, configuration, lifecycle, and constructor injection
- Starters, auto-configuration, configuration properties, profiles, startup, embedded server, Actuator, and external configuration
- Controller → Service → Mapper/Repository → SQL → Database responsibilities and dependency direction
- DTOs, domain models, persistence models, mapping, and separation of concerns
- Spring MVC controllers, mappings, path/query/body input, ResponseEntity, validation, exception handling, filters, interceptors, and argument resolvers
- application.yml, secrets, environment variables, type-safe settings, and local/test/production profiles
Hands-on labs
- Build the Spring Boot Task API from schema through tests, Docker, and deployment
Review examples, mistakes, interview prompts, and production concerns
Practical examples
- Implement a Task API using constructor injection, records for DTOs, a service transaction boundary, and a MyBatis mapper
Common mistakes
- Field injection, entity-shaped API contracts, business logic in controllers, or secrets committed in application.yml
Interview questions
- What does Spring Boot auto-configuration do, and where should a transaction boundary live?
Production considerations
- Fail fast on invalid configuration, keep Actuator exposure minimal, and separate environment-specific values from artifacts
Level 5
Production API Development
Turn a working Spring endpoint into a stable, validated, transactional, documented integration boundary.
Learning goals
- Implement DTO, validation, service orchestration, MyBatis, transaction, and error contracts
- Integrate external APIs and webhooks with bounded failure behavior
Prerequisites
- Level 4 Spring Boot application structure
Core concepts
- Request/response DTOs, domain models, mappers, validation, orchestration, persistence, and response shapes
- Bean Validation, custom and cross-field validation, database validation, business rules, and error messages
- Global exception handling, error codes, status mapping, validation/business/infrastructure failures, logs, and trace identifiers
- MyBatis interfaces, XML, dynamic SQL, result maps, binding, generated keys, batches, pagination, transactions, type handlers, SQL organization, and query tests
- @Transactional boundaries, propagation, rollback, checked exceptions, self-invocation, long transactions, and remote calls
- OpenAPI, request/error/auth examples, API versioning, timeouts, retries, circuit breakers, idempotency, webhooks, and signatures
Hands-on labs
- Build a production-style Task API with validation, RFC 9457 errors, MyBatis, transactions, OpenAPI, and integration tests
Review examples, mistakes, interview prompts, and production concerns
Practical examples
- Create an order atomically, publish an outbox record, return a documented response, and retry delivery outside the database transaction
Common mistakes
- Interpolating SQL with ${}, swallowing infrastructure failures, or keeping a database transaction open during an HTTP call
Interview questions
- Why can @Transactional fail on self-invocation, and what rolls back by default?
Production considerations
- Make timeouts, idempotency scope, compatibility policy, error taxonomy, and ownership observable
Level 6
Security
Apply identity, session, token, authorization, and OWASP controls as layered risk decisions rather than framework decoration.
Learning goals
- Explain Spring Security's filter and authentication architecture
- Choose session or token flows and enforce least privilege, ownership, and abuse controls
Prerequisites
- Levels 2 and 5: HTTP/browser behavior and production API boundaries
Core concepts
- Authentication, authorization, identity, principals, roles, permissions, least privilege, and defense in depth
- Password hashing/salting, BCrypt/Argon2, policies, reset, credential stuffing, and lockout
- Server sessions, Secure/HttpOnly/SameSite cookies, session fixation, logout, and CSRF
- Access/refresh tokens, JWT signing/claims/expiry, rotation, revocation, reuse detection, storage, and logout
- SecurityFilterChain, AuthenticationManager/Provider, UserDetailsService, PasswordEncoder, SecurityContext, filters, entry points, denied handlers, and method security
- Role/permission/ownership authorization at endpoint, method, and database layers
- Injection, XSS, CORS, CSRF, rate limiting, brute force, headers, secrets, log redaction, uploads, SSRF, and mass assignment
Hands-on labs
- Implement Basic, session, JWT/refresh rotation, permissions, login rate limits, password reset, and secure upload flows
Review examples, mistakes, interview prompts, and production concerns
Practical examples
- Compare secure session and short-lived access-token flows for a Next.js client without assuming JWT is superior
Common mistakes
- Disabling CSRF without understanding credentials, trusting token claims without validation, or using roles without resource ownership checks
Interview questions
- When would you choose a server session over JWT, and how does refresh-token rotation detect reuse?
Production considerations
- Model threats, rotate secrets, redact sensitive data, audit privileged actions, and test denial paths
Primary references
Level 7
Testing and Code Quality
Use fast isolated tests and realistic boundary tests to make backend behavior safe to change.
Learning goals
- Select unit, slice, integration, and end-to-end tests by risk
- Build deterministic fixtures and CI quality gates for Java/Spring/MyBatis changes
Prerequisites
- Levels 4–6 application, persistence, transaction, and security behavior
Core concepts
- Unit, integration, end-to-end, pyramid, isolation, determinism, mocks, stubs, and fakes
- JUnit, AssertJ, Mockito, parameterized tests, fixtures, and naming
- Service/controller/Security/MyBatis tests, MockMvc, Testcontainers, and full application tests
- Happy path, validation, authentication, authorization, conflict, rollback, idempotency, and concurrency tests
- Readability, naming, cohesion, coupling, SOLID, smells, refactoring, static analysis, formatting, and review
- Compile, lint, unit/integration tests, build, dependency/container scans, and deployment checks
Hands-on labs
- Add service, MockMvc security, MyBatis/PostgreSQL, rollback, idempotency, and concurrency tests
Review examples, mistakes, interview prompts, and production concerns
Practical examples
- Test an idempotent voucher service at the unit layer and against real PostgreSQL with concurrent requests
Common mistakes
- Mocking the database in an integration test, sharing mutable fixtures, or asserting only HTTP 200
Interview questions
- What belongs in a service unit test versus a Testcontainers integration test?
Production considerations
- Keep tests deterministic, parallel-safe, credential-free, and representative of the database dialect used in production
Level 8
Performance and Reliability
Measure bottlenecks, bound resource use, and design predictable behavior under concurrency and partial failure.
Learning goals
- Relate latency and throughput to CPU, memory, I/O, pools, queries, and locks
- Apply caching, timeout, retry, circuit, bulkhead, idempotency, and shutdown patterns safely
Prerequisites
- Levels 3, 5, and 7 database, API, and testing skills
Core concepts
- Latency, throughput, CPU, memory, I/O, profiling, connection pools, thread pools, and blocking
- Query/index/batch optimization, N+1, pagination, pool sizing, transaction length, locks, and deadlocks
- Local/distributed cache, cache-aside/read-through/write-through, TTL, invalidation, Redis, and stampede control
- Timeouts, retries, exponential backoff, jitter, circuit breaker, bulkhead, idempotency, graceful shutdown, health checks, and backpressure
- Optimistic/pessimistic locks, atomic updates, distributed-lock limits, races, and duplicate requests
Hands-on labs
- Load-test and optimize a list API; make payment and webhook handlers idempotent under concurrency
Review examples, mistakes, interview prompts, and production concerns
Practical examples
- Prevent duplicate payment, overselling, lost balance updates, duplicate webhooks, and slow list APIs with different controls
Common mistakes
- Retrying without a deadline or idempotency, caching mutable truth, or increasing pools until the database collapses
Interview questions
- How do you choose between an atomic SQL update, optimistic lock, and distributed lock?
Production considerations
- Define service budgets, measure percentiles, cap queues/pools, and test degraded dependencies before release
Level 9
Distributed Systems
Learn the coordination costs introduced when work crosses process, service, and data ownership boundaries.
Learning goals
- Compare layered monolith, modular monolith, and microservices honestly
- Design synchronous/asynchronous workflows with explicit consistency and duplicate-delivery behavior
Prerequisites
- Level 8 reliability, idempotency, timeouts, and concurrency
Core concepts
- Monolith, modular monolith, microservices, service boundaries, and when not to split
- Synchronous/asynchronous communication, queues, event-driven architecture, and eventual consistency
- Distributed transactions, saga, transactional outbox, and idempotent consumers
- Service discovery, API gateway, distributed tracing, CAP theorem, and consistency models
Hands-on labs
- Add an outbox and idempotent consumer to a modular commerce backend, then trace a message retry
Review examples, mistakes, interview prompts, and production concerns
Practical examples
- Keep voucher, order, and settlement modules in one deployable until ownership or scaling evidence justifies a split
Common mistakes
- Treating microservices as folder structure, assuming exactly-once delivery, or hiding consistency decisions
Interview questions
- Why is a modular monolith often safer than microservices for a small team?
Production considerations
- Prefer fewer failure boundaries; document delivery guarantees, ownership, schema evolution, and recovery procedures
Level 10
DevOps and Deployment
Build reproducible artifacts, secure containers, gated delivery, reverse proxying, database migration, and rollback.
Learning goals
- Package and containerize Spring Boot reproducibly
- Design a deployment pipeline with security checks, health verification, smoke tests, and rollback
Prerequisites
- Levels 4–8 working, tested, secure, and observable application behavior
Core concepts
- Maven, Gradle, JAR, profiles, reproducible builds, and dependency locking
- Images, containers, Dockerfile layers/cache, multi-stage builds, Compose, volumes, networks, health checks, non-root users, and scanning
- CI, continuous delivery/deployment, GitHub Actions, branch protection, pull-request checks, artifacts, approvals, and rollback
- Nginx reverse proxy, TLS termination, routing, assets, compression, timeouts, size limits, and headers
- VM, container hosting, managed platforms, Kubernetes overview, config, migrations, blue-green, rolling, canary, and rollback
- Secrets, backups, HTTPS, health, logs, monitoring, alerts, limits, rate limits, error pages, and tested rollback
Hands-on labs
- Create a multi-stage non-root image and a CI pipeline with immutable action pinning guidance and deployment verification
Review examples, mistakes, interview prompts, and production concerns
Practical examples
- Developer push → compile → test → image → scan → deploy → health check → smoke test → monitor
Common mistakes
- Running as root, embedding secrets, using mutable artifacts, migrating unsafely, or declaring success before smoke tests
Interview questions
- How would you deploy a schema and application change so either version can roll back safely?
Production considerations
- Promote the same artifact, separate build/deploy authority, back up before risk, and practice rollback
Level 11
Observability and Production Operations
Use logs, metrics, traces, health signals, alerts, and incident practice to operate a backend after deployment.
Learning goals
- Instrument requests without leaking sensitive data
- Detect, triage, mitigate, recover, and learn from production incidents
Prerequisites
- Level 10 deployed service and health-check lifecycle
Core concepts
- Log levels, structured/correlated/request/error/audit logs, redaction, and retention
- Request count, errors, latency, saturation, JVM, CPU, database/thread pools, and cache hits
- Trace IDs, spans, context propagation, distributed tracing, and OpenTelemetry
- Actuator health, metrics, info, readiness, liveness, and endpoint security
- Dashboards, threshold alerts, error budgets, alert fatigue, and on-call basics
- Detection, triage, mitigation, recovery, root cause, postmortem, and prevention actions
Hands-on labs
- Instrument a Spring API and run a database-connection-pool exhaustion incident exercise
Review examples, mistakes, interview prompts, and production concerns
Practical examples
- Investigate database pool exhaustion from latency/error symptoms through pool metrics, thread state, active queries, and transaction duration
Common mistakes
- Logging tokens or PII, alerting on every event, using liveness for downstream availability, or stopping at the first proximate cause
Interview questions
- Which signals distinguish a database pool leak from a database slowdown?
Production considerations
- Define owners and runbooks, secure management endpoints, control metric cardinality, and turn postmortems into verified actions
Level 12
Capstone Production System
Apply the roadmap to a fictional B2B voucher issuance, redemption, settlement, and audit platform.
Learning goals
- Turn product requirements into secure modules, constrained data, APIs, background work, tests, delivery, and operations
- Demonstrate production reasoning without exposing employer-confidential designs
Prerequisites
- Levels 0–11 or equivalent experience
Core concepts
- Users, roles, authentication, voucher lifecycle, redemption, administration, reporting, and immutable audit history
- Next.js client, Spring Boot API, MyBatis, PostgreSQL, justified Redis/jobs, Docker, GitHub Actions, Nginx, and monitoring
- CRUD, search, pagination, validation, errors, transactions, idempotency, audit logging, and rate limiting
- Schema constraints, indexes, migrations, backups, unit/integration/security tests, OpenAPI, CI, deployment, alerts, and rollback
Hands-on labs
- Complete the capstone milestones from requirements and schema through deployment and incident drill
Review examples, mistakes, interview prompts, and production concerns
Practical examples
- Redeem a voucher exactly once at the business level, record an audit event, and settle it asynchronously with observable retry
Common mistakes
- Copying a real employer workflow, adding Redis or microservices without a measured need, or omitting operational acceptance criteria
Interview questions
- Walk through the voucher redemption consistency boundary and every failure you expect.
Production considerations
- Use fictional data, explicit threat assumptions, rollback-compatible changes, backup/restore evidence, and actionable alerts
Primary references
Spring: Spring Boot 3.5.16 System Requirements (opens in a new tab)PostgreSQL Global Development Group: PostgreSQL 18 Documentation (opens in a new tab)MyBatis: MyBatis 3 Mapper XML Files (opens in a new tab)OWASP: Application Security Verification Standard 5.0 (opens in a new tab)Docker: Docker Build Best Practices (opens in a new tab)OpenTelemetry: OpenTelemetry Concepts (opens in a new tab)