AdvancedSpark · 15 min · 2 challenges

Shuffles: Advanced

Spark engineers turn a job from 20 shuffles into two by restructuring the work so the shuffles never need to happen at all. You already know how a shuffle writes, reads, spills, and gets sliced by the partition knob. This tier is the internals that make a shuffle survivable and the techniques that make it disappear: the file format under the hood, the service that serves shuffle data after a node dies, and the handful of restructurings, pre-partitioning, bucketing, map-side combine, that eliminate a shuffle entirely. It all points one way: the cheapest shuffle is the one you engineered away.

Sort-Based Shuffle Internals

Daily Life

Interviews

Early Spark had a shuffle implementation that did not scale, and understanding why it was replaced explains the design you rely on today. The original hash-based shuffle had each map task write a separate file for each reduce partition. With M map tasks and R reduce partitions, that is M times R files, and on a large cluster M times R is millions of tiny files. The operating system buckled under the file handles and the random I/O of opening millions of small files crushed performance.

Sort-based shuffle, the default for years now, fixes this. Each map task writes a single data file containing all of its buckets, sorted by reduce partition, plus one small index file that records where each bucket begins within that data file. So instead of M times R files, the cluster has 2M files, one data and one index per map task. A reduce task fetching its bucket uses the index to seek to the right offset in the data file and reads just its slice. The number of files now grows with the number of map tasks, not their product with reduce tasks, which is what makes it scale.

	Hash-based (old)	Sort-based (default)
Files per map task	One per reduce partition (R)	One data + one index (2)
Total files	M x R (millions at scale)	2M (linear in map tasks)
How reduce finds its data	Open its own file from each map	Seek by offset using the index
Why it matters	Collapsed under file-handle pressure	Scales to large clusters

Run the numbers to feel why the old design collapsed. A modest large job might have 10,000 map tasks and 10,000 reduce partitions. Hash-based shuffle would create 10,000 times 10,000, 100 million files, most of them tiny, scattered across the cluster's disks. Every one needs a file handle, an inode, and an open-seek-read on the fetch side; operating systems start failing well before 100 million open files, and even short of failure the random I/O of touching that many small files is ruinous. Sort-based shuffle on the same job creates 20,000 files, two per map task, and the reduce side does a handful of indexed seeks into large sequential files instead. The difference is quadratic versus linear in the task counts, which is the difference between a design that scales and one that does not.

The practical reason to know this is that it explains shuffle behaviour you will otherwise find mysterious. The index files, the sort that happens on the map side, the single large shuffle file per task: these are all sort-based shuffle, and they are why the write side sorts and why disk layout matters. When you read about shuffle internals or see shuffle files on disk, this is the structure you are looking at.

It also explains a real tuning lever. Because the map side sorts its output by partition id, very high partition counts make that sort more expensive and produce larger index files, while very low partition counts give you the oversized partitions that spill on the read side. Sort-based shuffle is what makes a high spark.sql.shuffle.partitions affordable at all, since the file count grows only with map tasks rather than with the product, but the per-record sort is not free. The structure under the hood is therefore part of why the partition count is a tradeoff rather than a free dial you can turn arbitrarily high.

The External Shuffle Service

Daily Life

Interviews

There is a problem with shuffle files living on an executor's local disk: what happens to them when that executor dies or is taken away? The reduce tasks still need those buckets, but the process that wrote them is gone. Without a solution, losing an executor mid-shuffle would force the map tasks that ran on it to be recomputed, the kind of expensive cascade you want to avoid. The external shuffle service is that solution.

The external shuffle service is a separate, long-lived process that runs on each worker node, independent of any single executor. Map tasks write their shuffle files, and the shuffle service, not the executor, is what serves those files to the reduce side. So even if the executor that produced the data has exited, its shuffle files are still on the node and the shuffle service can still hand them out. The shuffle data outlives the process that created it.

A node-level service

One shuffle service per worker node, separate from the executors, serving shuffle files on their behalf.

Shuffle data outlives the executor

Reduce tasks fetch from the service, so a dead executor does not lose its already-written shuffle output.

The key to dynamic allocation

Executors can be removed when idle without destroying shuffle data, which is what makes elastic scaling safe.

Contrast the two failure stories to see what the service buys. Without it, an executor that dies mid-job takes its shuffle files to the grave, so Spark must mark every map task that ran on that executor as lost and recompute it from the input, then re-run the affected fetches. On a long pipeline where the lost executor produced output many stages ago, that recomputation can cascade backward through the lineage and cost more than the failure itself. With the service, the files outlive the executor, so the reduce side simply keeps fetching them from the node's shuffle service as if nothing happened, and the only thing lost is the in-flight task the executor was running when it died. The blast radius of an executor loss shrinks from a recompute cascade to a single re-run.

This is also the unsung enabler of dynamic allocation, the feature that lets Spark add and remove executors based on load. The whole point of dynamic allocation is to release executors you are not using, but if releasing an executor destroyed its shuffle files, you could never safely scale down mid-job. Because the external shuffle service holds the files, an idle executor can be reclaimed without losing its shuffle output. The service is a reliability feature and also the precondition for elastic clusters, which is why dynamic allocation requires it to be on.

Pricing a Shuffle

Daily Life

Interviews

A senior engineer can estimate a shuffle's cost before running it, and the estimate starts from one number: how many bytes the shuffle moves. That is roughly the size of the data entering the wide operation, possibly reduced if a pre-aggregation shrinks it first. Knowing the bytes, you can reason about the wall-clock, because the bytes have to be written to disk, sent over the network, and read back, and each of those has a rate you can ballpark.

You are not computing an exact number. You are building the instinct that a shuffle of 10 gigabytes and a shuffle of 10 terabytes are 1000-fold different problems, and sizing your cluster and partitions accordingly. If a shuffle moves a terabyte and your network carries a few gigabytes per second across the cluster, the transfer alone is minutes, and that is before disk and serialisation. When you can put rough numbers on a shuffle, you can predict whether a job will fit its window and whether a proposed optimisation will actually matter.

Lever on shuffle cost	What it changes	How to pull it
Bytes entering the shuffle	The base volume everything scales from	Filter and pre-aggregate before the wide op
Partition count	Per-partition size; spill risk	Size to roughly data over 128MB
Number of shuffles	How many times you pay the whole stack	Restructure to remove wide ops
Skew	Whether one partition stalls the barrier	Salt or isolate hot keys

Work a back-of-the-envelope number to make the instinct usable. Say a shuffle moves 500 gigabytes, your cluster's effective cross-machine bandwidth for the shuffle is around 5 gigabytes per second once contention is accounted for, and the shuffle data is written and read once on each side. The network transfer alone is 500 over 5, 100 seconds, and the disk write and read add comparable time on top, so you are reasoning about a few minutes of pure shuffle even before any compute. Now imagine someone proposes an optimisation that halves the post-shuffle CPU but leaves the 500 gigabytes moving; you can see immediately it barely dents a number dominated by data movement. Pricing tells you which proposed changes touch the dominant term and which polish a rounding error.

The biggest lever is almost always reducing the bytes that enter the shuffle, because everything else scales from that number. A filter that runs before the wide operation, or a partial aggregation that collapses many rows into few before they shuffle, can shrink a shuffle tenfold, and cutting the bytes tenfold cuts the cost by about the same. Which leads to the most powerful move of all: not shuffling at all.

Shrink the bytes before the shuffle

The demo below filters and aggregates so that far fewer rows reach the wide operation. The filter is the cheap lever that cuts the bytes entering the shuffle; run it and picture the same logic on a billion-row table, where filtering first means the shuffle moves a fraction of the data.

(order_items
   .filter(F.col("quantity") > 2)
   .groupBy("product_id")
   .agg(F.sum("unit_price").alias("total"))
   .orderBy(F.col("total").desc()))

The filter runs before the groupBy, so the shuffle only carries the rows that survived it. On real data, the more selective that filter, the cheaper the shuffle, because the shuffle's cost scales directly with the bytes you let into it. Short of removing the shuffle outright, cutting bytes early is the best lever you have.

Eliminating a Shuffle

Daily Life

Interviews

Several ways exist to restructure a job so a shuffle you expected does not occur. These are the strongest optimisations in Spark, because removing a shuffle removes the entire stacked cost at once rather than a piece of it. 3 techniques cover most cases, and a strong candidate can name all 3.

The first is map-side combine, and it is the classic reduceByKey versus groupByKey distinction. If you are aggregating, you can often reduce within each partition before the shuffle, so that only the partial results cross the network instead of every row. Summing a billion rows into a few thousand partial sums on the map side means the shuffle moves a few thousand rows, not a billion. The aggregation still needs a shuffle to combine the partials, but it moves a tiny fraction of the data. groupByKey skips this and shuffles everything; reduceByKey and the DataFrame aggregations do the map-side combine for you.

⚠Shuffle everything (groupByKey style)

Every row crosses the network
The shuffle moves the full dataset
Expensive, and risks spill and skew
No reduction before the network

•Map-side combine (reduceByKey style)

Partial-aggregate on each partition first
Only the small partials shuffle
Orders of magnitude less data moved
The default for DataFrame aggregations

The second is broadcast, for joins. If one side of a join is small enough, Spark can ship a full copy to every executor, and then each executor joins its local partition of the big side against the in-memory small side, with no shuffle of the big side at all. The big table never moves. This turns a two-sided shuffle into a one-time broadcast, and for a large fact joined to a small dimension it is the most important join optimisation you have.

Broadcast has a sharp edge worth naming, because it is the failure mode interviewers probe. The small side has to fit comfortably in each executor's memory, and a full copy is shipped to every executor, so broadcasting something that is not actually small floods the cluster and can drive executors into out-of-memory deaths. Spark will auto-broadcast a side it estimates is under spark.sql.autoBroadcastJoinThreshold, 10 megabytes by default, and you can force it with the broadcast hint when you know a side is small but Spark's estimate is stale, for example after a filter that Spark cannot see through. The discipline is to broadcast the genuinely small dimension and never the fact table, and to remember that a wrong broadcast is worse than the shuffle you were trying to avoid.

The third is pre-partitioning and bucketing, which is shuffle elimination paid for at write time. If you bucket a table by its join or group key when you write it, the data is already organised so that matching keys sit together on disk. A later join or aggregation on that key can then read the data already co-located and skip the shuffle entirely. You paid the reorganisation cost once, when you wrote the table, so every read that joins on that key afterward is shuffle-free. For a table joined the same way repeatedly, this amortises the shuffle to zero.

Broadcast the small side

The fill-in below joins the large order_items table to the small products dimension and aggregates. The move that eliminates the join shuffle is broadcasting the small side, so the large table never moves. Supply the broadcast wrapper on the dimension and the aggregation that follows.

> Join order_items to the small products table, broadcasting products so the large side never shuffles, and return total quantity per category, highest first. The broadcast is what removes the join shuffle.

(order_items
   .join(___(products), "product_id")
   .groupBy("category")
   .agg(F.___("quantity").alias("units"))
   .orderBy(F.col("units").desc(), F.col("category").asc()))

broadcast

sum

repartition

count

Wrapping products in broadcast tells Spark to ship the small dimension to every executor, so order_items joins against an in-memory copy with no shuffle of the big side. The groupBy after it still shuffles, but you have removed one of the two wide operations entirely, which on a 500GB fact decides whether the job fits its window.

The Shuffle Tuning Knobs

Daily Life

Interviews

When you cannot eliminate a shuffle, you tune it, and there is a small set of knobs beyond the partition count that shape how a shuffle performs. None of them is as powerful as removing the shuffle or sizing the partitions, but together they trim the edges, and knowing they exist is part of a complete picture.

Knob	What it controls	When to reach for it
Shuffle compression	Whether shuffle files are compressed	On by default; trades CPU for less disk and network
Shuffle buffer sizes	Memory used for the sort and fetch	Raise to reduce spill on large partitions
Fetch concurrency	How many buckets a reduce task pulls at once	Tune for network throughput vs memory
spark.sql.shuffle.partitions	Post-shuffle partition count	The first and biggest knob; size to the data

Shuffle compression is on by default and usually worth keeping, because the CPU cost of compressing is small next to the disk and network it saves; the data being shuffled is often compressible row data. The buffer sizes govern how much memory the sort and fetch can use before spilling, so raising them can relieve spill on large partitions, though sizing the partitions smaller is usually the cleaner fix. Fetch concurrency balances how aggressively a reduce task pulls against how much memory and bandwidth it consumes.

Skew deserves its own mention here because no knob in the table fixes it and it is the most common reason a well-sized shuffle still stalls. If one key holds a wildly disproportionate share of the rows, a single hot product id in order_items, then the reduce task that owns that key receives a giant partition no matter how many partitions you configured, because the partitioner sends all of that key to one place. Raising the partition count does nothing, since the hot key cannot be split across tasks. The real fixes are structural: salt the hot key by splitting it into several sub-keys and aggregating in two passes, isolate the hot keys and handle them separately, or lean on adaptive query execution's skew-join handling, which detects an oversized partition and splits it automatically. For skew, the answer is a different shape of job, and no setting substitutes.

The honest framing for an interview is that these knobs are the last 10 percent. The order of operations for shuffle performance is always the same: first try to eliminate the shuffle by restructuring, then reduce the bytes entering it by filtering and pre-aggregating, then size the partition count so nothing spills, and only then reach for compression and buffer knobs. An engineer who jumps straight to the buffer settings on a job that should have broadcast its small side is optimising the wrong thing. Reach for the knobs last.

✓Do

Eliminate a shuffle first: map-side combine, broadcast a small side, or bucket at write time.
Reduce the bytes entering a shuffle by filtering and pre-aggregating before the wide op.
Size the partition count so nothing spills before reaching for buffer knobs.
Rely on the external shuffle service so a lost executor does not destroy shuffle output.

✗Don't

Don't reach for buffer and compression knobs before trying to remove the shuffle.
Don't groupByKey when a map-side-combine aggregation moves orders of magnitude less data.
Don't shuffle a large table to join it when the other side is small enough to broadcast.
Don't re-bucket a table on every read; pay the reorganisation once at write time.

❯❯❯PUTTING IT ALL TOGETHER

> A pipeline joins a 500GB fact table to a 50MB dimension and then aggregates, and it shuffles both the join and the aggregation, missing its SLA. The same fact table is joined this way in several downstream jobs.

The dimension is tiny, so you broadcast it; the 500GB fact never shuffles for the join, removing one whole shuffle.

For the aggregation you ensure a map-side combine so only partial sums cross the network, shrinking the second shuffle.

Because several jobs join the fact on the same key, you bucket it on that key at write time so future joins are shuffle-free.

Only after those structural wins do you size the remaining shuffle's partitions to 128MB and confirm no spill in the UI.

KEY TAKEAWAYS

Sort-based shuffle writes one data plus one index file per map task, scaling where hash-based did not.

The external shuffle service serves shuffle files after an executor dies, which is what makes dynamic allocation safe.

Price a shuffle from the bytes it moves; reducing those bytes is the biggest lever on its cost.

Eliminate shuffles with map-side combine, broadcasting a small join side, or write-time bucketing.

Tune shuffles in order: eliminate, reduce bytes, size partitions, then compression and buffer knobs last.

The cheapest shuffle is the one you engineered away.

Category: Spark
Difficulty: advanced
Duration: 15 minutes
Challenges: 2 hands-on challenges

Topics covered: Sort-Based Shuffle Internals, The External Shuffle Service, Pricing a Shuffle, Eliminating a Shuffle, The Shuffle Tuning Knobs

Lesson Sections

Sort-Based Shuffle Internals (concepts: paShuffleOptimization)
Early Spark had a shuffle implementation that did not scale, and understanding why it was replaced explains the design you rely on today. The original hash-based shuffle had each map task write a separate file for each reduce partition. With M map tasks and R reduce partitions, that is M times R files, and on a large cluster M times R is millions of tiny files. The operating system buckled under the file handles and the random I/O of opening millions of small files crushed performance. Sort-base
The External Shuffle Service (concepts: paShuffleOptimization)
There is a problem with shuffle files living on an executor's local disk: what happens to them when that executor dies or is taken away? The reduce tasks still need those buckets, but the process that wrote them is gone. Without a solution, losing an executor mid-shuffle would force the map tasks that ran on it to be recomputed, the kind of expensive cascade you want to avoid. The external shuffle service is that solution. The external shuffle service is a separate, long-lived process that runs
Pricing a Shuffle (concepts: paShuffleOptimization)
A senior engineer can estimate a shuffle's cost before running it, and the estimate starts from one number: how many bytes the shuffle moves. That is roughly the size of the data entering the wide operation, possibly reduced if a pre-aggregation shrinks it first. Knowing the bytes, you can reason about the wall-clock, because the bytes have to be written to disk, sent over the network, and read back, and each of those has a rate you can ballpark. You are not computing an exact number. You are bu
Eliminating a Shuffle (concepts: paBroadcastJoin)
Several ways exist to restructure a job so a shuffle you expected does not occur. These are the strongest optimisations in Spark, because removing a shuffle removes the entire stacked cost at once rather than a piece of it. 3 techniques cover most cases, and a strong candidate can name all 3. The first is map-side combine, and it is the classic reduceByKey versus groupByKey distinction. If you are aggregating, you can often reduce within each partition before the shuffle, so that only the partia
The Shuffle Tuning Knobs (concepts: paShuffleOptimization)
When you cannot eliminate a shuffle, you tune it, and there is a small set of knobs beyond the partition count that shape how a shuffle performs. None of them is as powerful as removing the shuffle or sizing the partitions, but together they trim the edges, and knowing they exist is part of a complete picture. Shuffle compression is on by default and usually worth keeping, because the CPU cost of compressing is small next to the disk and network it saves; the data being shuffled is often compres