<< Back to article

System Boundaries

System boundaries define the limits of a system's responsibility, control, and influence. Understanding boundaries is essential for designing resilient, maintainable, and secure architectures. Boundaries exist at multiple levels: network, process, namespace, and organisational.

Physical Boundaries

Physical boundaries separate systems by hardware:

  • Network segments: Firewalls, routers, and switches define network perimeters.
  • Data centres: Physical facilities with controlled access.
  • Host isolation: Bare metal vs virtualised vs containerised.

Network Boundaries

Network boundaries control traffic flow between security zones:

  • Perimeter firewall: Defines the outer boundary of a network.
  • DMZ (Demilitarised Zone): Separates public-facing services from internal networks.
  • VLANs: Logical segmentation within a physical network.
  • VPN tunnels: Secure boundaries over untrusted networks.

A zero-trust architecture treats every network as potentially hostile, requiring authentication and authorisation for every request.

Process Boundaries

Operating systems enforce boundaries between processes:

  • Memory isolation: Each process has its own virtual address space.
  • User/group permissions: Restrict file and resource access.
  • Capabilities: Fine-grained privilege separation.
  • Namespaces: Linux namespaces isolate PIDs, networks, filesystems, and users.
  • cgroups: Limit resource usage per process group.

See Article - Lightweight OS virtualisation techniques (chroot, namespace) for namespace details.

Service Boundaries

In microservice architectures, services communicate over well-defined APIs:

  • API contracts: Versioned interfaces between services.
  • Message queues: Asynchronous boundaries (Kafka, RabbitMQ).
  • Service meshes: Infrastructure layer managing service-to-service communication (Istio, Linkerd).

Data Boundaries

Data boundaries control information flow:

  • Encryption at rest: Databases, filesystems, object storage.
  • Encryption in transit: TLS for all network communication.
  • Data classification: Public, internal, confidential, restricted.
  • Data loss prevention (DLP): Monitoring and controlling data exfiltration.

Organisational Boundaries

In platform engineering and DevOps, boundaries define team responsibilities:

  • Platform team: Provides shared services and infrastructure.
  • Product teams: Own applications running on the platform.
  • Security team: Defines policies and audits compliance.

Clear boundaries reduce coupling, improve autonomy, and simplify incident response.

Boundary Violations

Common boundary violations include:

  • Running services as root when not required.
  • Exposing internal services to the public internet.
  • Shared databases between services (tight coupling).
  • Overly permissive firewall rules.
  • Lack of input validation at service boundaries.