A structured, opinionated path from zero to senior backend engineer in 2026. No fluff — just the skills, tools, and concepts that actually matter in production.
Star this repo ⭐ and revisit as you progress. Check off what you've learned.
- How to Use This Roadmap
- Phase 1: Foundations
- Phase 2: Core Backend Skills
- Phase 3: Databases Deep Dive
- Phase 4: APIs & Communication
- Phase 5: DevOps & Infrastructure
- Phase 6: System Design & Architecture
- Phase 7: Advanced Topics
- Phase 8: Senior-Level Skills
- Project Ideas by Level
- Related Repos
- Don't learn everything — pick one language, one framework, one cloud
- Build projects at each phase before moving on
- Depth > breadth — knowing one stack deeply beats knowing five shallowly
- Items marked with ⭐ are highest priority for 2026 job market
| Language | Best For | 2026 Job Market |
|---|---|---|
| Go ⭐ | Microservices, cloud-native, CLI tools | Very high demand, top backend salaries |
| Python ⭐ | AI/ML backends, data pipelines, rapid prototyping | Massive demand (AI boom) |
| Java | Enterprise, fintech, Android backends | Steady, huge legacy + new projects |
| C#/.NET | Enterprise, Azure ecosystem, game backends | Growing, especially with .NET 9+ |
| TypeScript | Full-stack, Node.js backends | High demand, especially startups |
| Rust | Systems, performance-critical services | Niche but growing fast |
What to learn in your chosen language:
- Variables, types, control flow
- Functions, error handling, exceptions
- Data structures (arrays, maps, sets, linked lists)
- OOP concepts (classes, interfaces, inheritance, polymorphism)
- Modules, packages, dependency management
- File I/O, JSON parsing
- Concurrency basics (threads, async/await, goroutines)
- Unit testing
- Big O notation — time and space complexity
- Data structures — arrays, hash maps, trees, graphs, heaps
- Algorithms — sorting, searching, BFS/DFS, dynamic programming basics
- Networking — HTTP/HTTPS, TCP/IP, DNS, how the internet works
- OS basics — processes, threads, memory, file systems
- Branching strategies (Git Flow, trunk-based)
- Rebasing vs merging
- Conventional commits
- Pull request workflows
📘 See also: git-cheatsheet
| Language | Framework | Why |
|---|---|---|
| Go | Standard library / Gin / Echo | Go's stdlib is already a framework |
| Python | FastAPI ⭐ / Django | FastAPI for modern APIs, Django for full-stack |
| Java | Spring Boot ⭐ | Dominant in enterprise |
| C# | ASP.NET Core | Excellent performance, great DX |
| TypeScript | NestJS / Hono / Fastify | NestJS for structure, Hono for edge |
| Rust | Axum / Actix | Axum is the modern choice |
- Request/response lifecycle
- Status codes (know 200, 201, 204, 301, 400, 401, 403, 404, 409, 422, 429, 500)
- Headers (Content-Type, Authorization, Cache-Control, CORS)
- Cookies vs tokens
- HTTPS, TLS, certificates
- Session-based auth (cookies)
- JWT (access + refresh tokens)
- OAuth 2.0 / OpenID Connect
- API keys
- Role-Based Access Control (RBAC)
- Attribute-Based Access Control (ABAC)
- Passkeys / WebAuthn (2026 trend)
- Never trust client input
- SQL injection prevention (parameterized queries)
- XSS prevention
- CSRF protection
- Rate limiting
- OWASP Top 10
- Unit tests
- Integration tests
- API tests (Postman, HTTPie, REST Client)
- Test-Driven Development (TDD) basics
- Mocking and stubbing
- Code coverage (aim for 80%+ on business logic)
Pick one and go deep:
| Database | When to Use |
|---|---|
| PostgreSQL ⭐ | Default choice for most backends |
| MySQL | WordPress, legacy apps, simpler needs |
| SQL Server | .NET ecosystem, enterprise |
What to master:
- Schema design and normalization (1NF-3NF)
- Indexes (B-tree, hash, composite, partial, covering)
- Query optimization (EXPLAIN ANALYZE)
- Joins (INNER, LEFT, RIGHT, FULL, CROSS)
- Transactions (ACID, isolation levels)
- Migrations (Flyway, Alembic, EF Migrations)
- Connection pooling (PgBouncer, HikariCP)
- Stored procedures vs application logic (prefer app logic)
📘 See also: postgres-vs-mysql | sql-joins-cheatsheet
| Database | Type | When to Use |
|---|---|---|
| Redis ⭐ | Key-value / cache | Caching, sessions, rate limiting, queues |
| MongoDB | Document | Flexible schemas, rapid prototyping |
| Elasticsearch | Search engine | Full-text search, log aggregation |
| DynamoDB | Key-value / document | AWS-native, extreme scale |
| Cassandra | Wide-column | Time series, IoT, write-heavy |
What to learn:
- When to use SQL vs NoSQL (hint: start with SQL)
- Redis patterns (cache-aside, pub/sub, rate limiting, leaderboards)
- Document modeling (denormalization trade-offs)
- CAP theorem (consistency vs availability vs partition tolerance)
| Approach | Pros | Cons |
|---|---|---|
| ORM (Prisma, SQLAlchemy, EF Core) | Fast development, type safety | N+1 queries, complex queries are painful |
| Query builder (Knex, Drizzle, jOOQ) | More control, still type-safe | More verbose |
| Raw SQL | Full control, best performance | No type safety, migration pain |
Recommendation: Use an ORM for CRUD, drop to raw SQL for complex queries and reports.
- Resource naming (
/users/{id}/orders, not/getUserOrders) - HTTP methods (GET, POST, PUT, PATCH, DELETE)
- Pagination (cursor-based > offset-based)
- Filtering and sorting
- Versioning (URL path
/v1/or header) - Error response format (RFC 7807 Problem Details)
- HATEOAS (know what it is, skip implementing it)
- OpenAPI / Swagger documentation
- When to use GraphQL vs REST (don't default to GraphQL)
- Queries, mutations, subscriptions
- N+1 problem and DataLoader
- Schema design
- Tools: Apollo, Strawberry, Netflix DGS
- Protocol Buffers (protobuf)
- Unary, server streaming, client streaming, bidirectional
- When to use: internal service-to-service communication
- gRPC-Web for browser clients
- Connect-RPC (modern alternative)
| Tool | Best For |
|---|---|
| Kafka ⭐ | Event streaming, high-throughput, event sourcing |
| RabbitMQ | Task queues, complex routing |
| SQS/SNS | AWS-native, simple queues |
| NATS | Lightweight, cloud-native messaging |
| Redis Streams | Simple streaming on existing Redis |
Patterns to learn:
- Publish/subscribe
- Work queues (competing consumers)
- Event sourcing
- CQRS (Command Query Responsibility Segregation)
- Saga pattern (distributed transactions)
- Dead letter queues
- Idempotency
📘 See also: kafka-vs-rabbitmq
- WebSocket protocol
- Server-Sent Events (SSE) — simpler for one-way
- Socket.IO, SignalR
- When to use polling vs WebSockets vs SSE
- File system navigation, permissions
- Process management (ps, top, htop, kill)
- Package managers (apt, yum, brew)
- Shell scripting basics (bash)
- SSH, SCP, rsync
- systemd services
- Log files (
/var/log, journalctl)
📘 See also: linux-one-liners
- Dockerfile best practices (multi-stage builds)
- Docker Compose for local dev
- Image optimization (Alpine, slim, distroless)
- Volumes, networks, health checks
- Private registries (ECR, ACR, GHCR)
📘 See also: docker-cheatsheet | docker-vs-podman
- GitHub Actions (most common in 2026)
- Pipeline stages: lint → test → build → deploy
- Secret management in pipelines
- Branch protection rules
- Automated releases (semantic-release)
📘 See also: production-ready-snippets
| Provider | Best For | Key Services |
|---|---|---|
| AWS | Everything, market leader | EC2, ECS, Lambda, RDS, S3, SQS |
| Azure | .NET shops, enterprise | App Service, AKS, Functions, SQL |
| GCP | Data/ML, Kubernetes | GKE, Cloud Run, BigQuery, Cloud Functions |
Essential services to know on any cloud:
- Compute (VMs, containers, serverless)
- Object storage (S3/Blob/GCS)
- Managed databases (RDS/Cloud SQL)
- Load balancers
- IAM (Identity & Access Management)
- Networking (VPCs, subnets, security groups)
- Terraform ⭐ — multi-cloud standard
- Pulumi (if you prefer real programming languages)
- CloudFormation / Bicep (cloud-specific)
- Don't click-ops in production
- Pods, Deployments, Services, Ingress
- ConfigMaps, Secrets
- Health checks (liveness, readiness, startup)
- Horizontal Pod Autoscaler
- Helm charts
- Don't use K8s unless you have 10+ services and a platform team
- Monolith first — start here, split later
- Modular monolith (the sweet spot for most teams)
- Microservices (when you actually need them)
- Event-driven architecture
- Serverless architecture
- CQRS + Event Sourcing
- Horizontal vs vertical scaling
- Load balancing (round-robin, least connections, consistent hashing)
- Caching strategies (cache-aside, write-through, write-behind)
- CDNs
- Database sharding and replication
- Read replicas
- Connection pooling
- Circuit breaker pattern
- Retry with exponential backoff
- Bulkhead pattern
- Timeout propagation
- Graceful degradation
- Health checks and readiness probes
- Chaos engineering basics
Practice designing these systems:
- URL shortener
- Rate limiter
- Chat application
- Notification system
- File storage service (like S3)
- News feed / timeline
- Search autocomplete
- Distributed cache
| Pillar | Tools |
|---|---|
| Logs | ELK Stack, Loki + Grafana, Datadog |
| Metrics | Prometheus + Grafana, Datadog, CloudWatch |
| Traces | Jaeger, Zipkin, OpenTelemetry ⭐ |
- Structured logging (JSON logs)
- OpenTelemetry SDK integration
- Distributed tracing across services
- Alerting (PagerDuty, Opsgenie)
- SLIs, SLOs, SLAs
- Error budgets
- Profiling (CPU, memory, I/O)
- N+1 query detection
- Database query optimization
- Caching at every layer (app, CDN, database, OS)
- Connection pooling
- Async processing (offload to queues)
- Load testing (k6, Gatling, Locust)
- Secrets management (Vault, AWS Secrets Manager)
- Encryption at rest and in transit
- mTLS between services
- API gateway security
- Dependency scanning (Trivy, Snyk, Dependabot)
- SAST/DAST in CI/CD
- Compliance basics (SOC2, GDPR, HIPAA awareness)
- LLM API integration (OpenAI, Anthropic, Google)
- RAG (Retrieval-Augmented Generation) backends
- Vector databases (Pinecone, pgvector, Weaviate)
- Prompt management and versioning
- AI feature flags and A/B testing
- Cost management for AI API calls
- Streaming responses (SSE for LLM outputs)
📘 See also: ai-engineer-roadmap-2026 | langchain-vs-llamaindex
- Architecture Decision Records (ADRs)
- RFC process for technical proposals
- Code review best practices
- Mentoring junior developers
- Technical debt management
- Incident response and post-mortems
- Estimating work (hint: double your first estimate)
- Writing design docs
- Saying "no" to unnecessary complexity
- Cross-team communication
- Presenting technical concepts to non-technical stakeholders
| Mid-Level | Senior |
|---|---|
| Writes good code | Designs good systems |
| Solves assigned problems | Identifies problems worth solving |
| Follows patterns | Chooses the right pattern |
| Uses tools | Evaluates and selects tools |
| Delivers features | Delivers outcomes |
| Asks "how?" | Asks "should we?" |
- REST API — CRUD for a todo app with auth, validation, tests
- URL shortener — custom aliases, click tracking, expiration
- Blog API — posts, comments, tags, pagination, search
- E-commerce API — products, cart, orders, payments (Stripe), inventory
- Real-time chat — WebSockets, rooms, message history, typing indicators
- Job queue processor — Redis/RabbitMQ worker, retries, dead letter queue
- Notification service — email, SMS, push; templating, rate limiting, preferences
- API gateway — routing, auth, rate limiting, circuit breaking, logging
- Event-driven order system — Kafka, CQRS, saga pattern, eventual consistency
- Platform as a Service — multi-tenant API platform with auth, billing, usage metering
- Distributed task scheduler — like a mini Temporal/Airflow with DAGs, retries, observability
- Observability platform — ingest logs/metrics/traces, query engine, alerting
| Repo | What's Inside |
|---|---|
| devops-learning-path | DevOps roadmap from zero to production |
| ai-engineer-roadmap-2026 | AI/ML engineer learning path |
| spring-boot-advanced-roadmap | Advanced Spring Boot topics |
| postgres-vs-mysql | PostgreSQL vs MySQL compared |
| docker-cheatsheet | Docker commands quick reference |
| git-cheatsheet | Git commands cheat sheet |
| kafka-vs-rabbitmq | Kafka vs RabbitMQ compared |
| production-ready-snippets | Production-ready config snippets |
| awesome-dev-errors | Real error messages + proven fixes |
Found a missing skill? Better resource? Outdated recommendation? PRs welcome — see CONTRIBUTING.md.