Security Notes
System Design

Design a Local Delivery Service (DoorDash / Instacart)

3 min read 6 sections

DifficultyEasy | HelloInterview: problem breakdown


Problem Statement

Design a local delivery service where customers order from local businesses (restaurants, grocery stores), dashers (delivery drivers) pick up and deliver orders, and customers track their delivery in real-time.

๐Ÿ“–

Real-world: DoorDash/Instacart blend two patterns you've seen elsewhere โ€” the geospatial matching of Uber (find nearby available dashers) and the state machine of an order moving through placed โ†’ accepted โ†’ picked-up โ†’ delivered, with live location tracking over WebSocket. The interesting wrinkle versus Uber is the two-sided, multi-leg coordination: the dasher, the merchant (is the food ready?), and the customer all need consistent state, and demand is spiky around meal times. Security/integrity angles worth raising: payment fraud and promo abuse (fake accounts farming first-order discounts is a massive cost center for these apps), GPS spoofing by drivers to fake deliveries or game incentive zones, and PII minimization โ€” the customer's address and phone are sensitive, so mature designs mask phone numbers (proxy numbers) and limit how long the dasher can see the address. "How do you stop a driver from spoofing a delivery?" is a fun curveball.


Requirements

Functional

  • Browse nearby businesses and menus
  • Place order โ†’ payment โ†’ assigned to dasher
  • Real-time order tracking (customer tracks dasher)
  • Dasher app: accept/decline orders, navigate to pickup + delivery

Non-Functional

  • 10M orders/day โ†’ 115 orders/s average; 500/s peak
  • Dasher location update: every 5s โ†’ 500k active dashers ร— 0.2/s = 100k location updates/s
  • Order assignment latency: < 30 seconds
  • Real-time tracking: < 5s location lag

Core Design

Dasher Matching

Similar to Uber: geohash-based location index in Redis.

On new order:
  1. Get pickup location geohash
  2. Query Redis for available dashers in geohash cell + neighbors
  3. Filter: unoccupied dasher, correct vehicle type, rating >= threshold
  4. Rank by: proximity + estimated pickup time
  5. Send request to top 3 dashers (first to accept wins)
  6. Timeout 15s: if no accept, expand radius, try next batch

Order State Machine

PLACED โ†’ CONFIRMED (business accepts) โ†’ READY_FOR_PICKUP โ†’
PICKED_UP โ†’ EN_ROUTE โ†’ DELIVERED

State transitions trigger:

  • Push notifications to customer
  • Business notifications
  • Analytics events

Real-Time Tracking

Dasher app โ†’ location update every 5s โ†’ Location Service โ†’ Redis (TTL 30s)

Customer app subscribes to dasher location for their active order:

  • WebSocket: subscribe order:{order_id}:dasher_location
  • Server polls Redis for dasher location, pushes updates to all subscribed customers

ETA: distance_to_destination / average_speed_for_area_and_time โ€” or integrate with Google Maps Directions API.


Architecture

Customer App โ†’ Order Service โ†’ Payment Service โ†’ Order DB (Postgres)
                                                        โ†“
                                           Dispatcher โ†’ Redis (dasher locations)
                                                        โ†“
                                           Notify Dasher App (push notification)
                                                        โ†“
                               Dasher Location Service โ†’ Redis โ†’ WebSocket โ†’ Customer
                                                        โ†“
                                           Business Notification Service

Security Considerations

ThreatMitigation
Customer address privacyShare address only with assigned dasher; never broadcast
Dasher impersonationUnique per-delivery QR code for ID verification
Payment fraud3DS2; ML fraud scoring; velocity limits
Location spoofingGPS validation; speed sanity checks; device attestation
Order injectionOnly authenticated users can place orders; validate cart before payment

Interview Tips

This is Uber for food delivery

same geo-index, same matching algorithm. The difference is the multi-party coordination (customer + restaurant + dasher).

Order state machine

is explicit and simple โ€” draw it; shows structured thinking.

ETA accuracy

is a product differentiator โ€” mention the feedback loop (actual delivery time โ†’ improve ETA model).