Determinism is what makes the collision possible. Two workers computing `thumbs/{tenant}/{asset_id}/320x180-webp` for the same asset are both behaving correctly [2]. In the example the author gives, worker A is holding bytes from revision 7 while worker B starts on revision 8, and both target that one key [8]. The storage API will report success, because writing the wrong picture is still a successful write [8]. There is no `If-Match` on this surface, so there is no compare-and-swap to lose [7]. The containment is a per-asset queue, or a database transaction that checks the source digest before it commits readiness, because object storage alone does not give the job the strict mutex it needs [9].
That readiness flag is also why the database is authoritative and not merely convenient. Server-side object metadata search is not available, and prefix listing is an operational tool rather than a query engine [3]. So the row holds ownership, width, height, format, variant name and generation status [3]. Any question of the form "which assets are missing their 320x180 WebP" is a SQL question, and it stays one no matter how tidy the key space gets.
One rule on the read path is easy to get wrong in a helper function. The Infrai bearer token must never be attached to the presigned URL you hand back, since that URL already carries its own temporary authorization [5]. Polling is the other half: a client that sees a pending row retries the application endpoint rather than the bucket, and the worker only marks the row ready after storage accepts the object [16].
Count the boundaries on the critical path and the vendor's share of this design is small. There are four: the app authenticates the user, storage persists the original, a worker generates variants, and the app creates signed download links after checking tenant access [15]. Three of those four are application code [19]. The write itself goes over a plain REST surface with an explicit method, a bearer token, an idempotency key and a bounded 429 retry, with no storage SDK or client-library version to install [17]. The sample is Python while the surrounding SaaS is Node, which the author points out changes nothing about the boundary [18].
The gaps are where the design stops, and they are the part to check against your own retention rules. The one-day floor on lifecycle expiry is 24 times an hourly target, so short-lived variant garbage is the application's job to delete [20]. Multipart fragments get no automatic cleanup rule either [11]. Self-service bucket CORS configuration is unavailable, and that single line decides whether browser-direct upload is on the table at all [12].
On price the piece is narrow and says so: object storage holds bytes while compute does transient transformation, which is not a claim that any provider is cheapest, and storage, transformation CPU, delivery and egress each need measuring against the real image mix [13]. The author states plainly that no provider can be ranked without thumbnail sizes, cache-hit ratio, retention, request rate and delivery geography, and that a one-week trace or a representative load test would settle it [14]. For the rest of this to transfer, your variant set has to be enumerable in advance, your retention granularity has to be coarser than a day, and your uploads have to arrive through your own server. If any of those is false, you are buying the key space and paying for the gaps.
