In a runtime-integrated microfrontend system using Webpack Module Federation, concretely describe what happens in the browser from the moment a host page loads to the moment a remote microfrontend's UI is rendered.
answer
- remoteEntry.js is a manifest, not the app
- shared scope singleton negotiation
- two network requests: manifest then chunk
- no compile-time check across host/remote boundary
basics
~20 sThe host page loads a small manifest file from the microfrontend's server that tells the browser where to fetch its actual code, then the browser downloads and runs that code on the spot and slots it into the page.
solid answer
~40 sThe host application ships with 'remotes' configured — URLs pointing at each microfrontend's remoteEntry.js manifest rather than the microfrontend's actual bundled code. When the host needs a remote module, it fetches that remote's remoteEntry.js, which exposes a small runtime container describing what modules the remote offers and what shared dependencies, like React or a state library, it expects. The federation runtime then resolves shared dependencies against a shared scope — reusing the host's copy if versions are compatible, or loading the remote's own copy if not — before dynamically importing and executing the actual remote chunk and mounting it into the DOM. All of this happens in the browser after the host's own bundle has already loaded, which is what makes it runtime rather than build-time integration.
go deeper
Can say the host fetches the remote's code live from a URL rather than having it bundled in.
Can walk the two-step fetch — the manifest, then the actual chunk — and knows shared dependencies get deduped.
Can explain singleton version negotiation and its failure mode, version skew and unsatisfied-version errors, and knows to add error boundaries and fallbacks for remote-load failures.
Can weigh Module Federation against alternatives like import maps with native ESM, iframes, or web components for a given org's deploy-independence needs, and articulate when the added runtime failure surface isn't worth it.
## The two sides of the mechanism Module Federation is a Webpack, and now Rspack and Vite-plugin, capability that lets independently built and independently deployed JavaScript bundles share code with each other at runtime rather than being combined into one bundle at compile time. The mechanism has two sides. - **On the remote side**, a microfrontend, say checkout, is built with a federation config that declares an exposes map, such as exposing `./App` from `./src/App.tsx`, and emits a small, separately-hostable JavaScript file, conventionally named `remoteEntry.js`, alongside its normal application bundle. `remoteEntry.js` is not the application code itself; it's a lightweight container/runtime that knows how to fetch and instantiate the actual exposed modules on demand, plus metadata about which shared libraries the remote needs and which versions it can tolerate. - **On the host side**, the shell application declares remotes — a name-to-URL mapping — and can then write ordinary-looking dynamic imports for the remote module. ## What the browser actually does Concretely, the browser sequence is: 1. The host's own bundle loads and executes first, just like any single-page app. 2. When the host's router or component tree reaches a point that needs the checkout remote, the federation runtime issues a network request for checkout's `remoteEntry.js`. 3. That file executes and registers itself in a shared federation registry in the browser's global scope. 4. The runtime then reconciles the shared scope: if both host and remote declare `react` as shared and singleton, the runtime picks one instance, usually the host's if version-compatible, so there's only one React in the page — critical, because two React copies mounting into the same tree causes broken context and hook errors. 5. Once shared deps are resolved, the runtime dynamically imports the actual checkout application chunk, a second network request separate from `remoteEntry.js`, executes it, and the host mounts the returned component into the DOM. All of this happens live in the user's browser after the host's own build has already shipped, which is exactly why it counts as runtime rather than build-time integration: the host's build artifact never contained checkout's code at all, only a URL pointing at where to find it later. ## Why the pattern exists The reason this pattern exists is deploy independence with a lighter type-safety trade-off than fully disjoint apps like iframes or separate page loads: teams get to ship on their own schedule while still sharing a single-page-app feel and shared runtime dependencies, avoiding the cost of shipping a framework like React multiple times per page. The trade-off is that all the safety Module Federation gives up compared to build-time integration — no compile-time type checking across the host/remote boundary, no bundler-level tree-shaking across the boundary — has to be managed operationally instead of caught by the compiler. ## Failure modes Failure modes are concrete and recur in production. 1. **Version skew on shared dependencies** is the most common: if checkout requires a React version as singleton that the host's range doesn't overlap, Module Federation either throws a runtime unsatisfied-version error or, worse, silently picks an incompatible version and produces obscure hook or context bugs that never show up in either team's own test suite, since each team only tests against their own dependency versions. 2. **A second failure mode is a remote being unreachable** — the CDN serving `remoteEntry.js` returns a 404 or times out — which the host must handle explicitly with error boundaries, retries, or fallback UI, since there's no compiler to catch a missing import; without that handling, a checkout outage silently blanks the whole checkout section of an otherwise-healthy host page. 3. **A third is contract drift**: because there's no shared type-checked interface, the checkout team can rename a prop the host relies on and nothing fails until a user hits that code path in production, which is why teams doing this seriously invest in contract tests or generated types published alongside `remoteEntry.js`. ## Where it shows up A well-known real-world adopter pattern is **Zalando's** frontend platform and, more publicly, **IKEA** and **DAZN**, who documented moving multiple independently-owned page sections onto Module Federation specifically to let dozens of frontend teams deploy on independent schedules without shipping a duplicate React runtime per microfrontend — the shared-scope negotiation described above is precisely the piece that makes that duplication avoidable.
- What happens if the host and a remote both declare react as a shared singleton but require incompatible version ranges?Module Federation's runtime will either throw an unsatisfied-version warning or error at load time, or fall back to loading both versions if not strictly configured as singleton, and if it silently picks one incompatible version anyway you typically see broken hooks or context errors that are hard to trace because neither team's own tests would catch it — each team only tests against their own version.
- Why is a network failure fetching remoteEntry.js a uniquely runtime-integration problem, not something build-time integration has to worry about?Because in build-time integration the remote's code is already inside the host's own bundle at deploy time, there's nothing to fetch live — if it compiled, it's there. In runtime integration the fetch happens on every affected page load in production, so a CDN blip or the remote team's deploy being mid-flight can degrade the host experience for real users, which is why teams add error boundaries and fallback UI around federated imports.
It's like a hotel concierge who doesn't hand you the room itself, but tells the front desk exactly which room to fetch the keys for and whether you can share an elevator, a shared library instance, with other guests already in the building.
saying these in an interview costs you the question
- thinks remoteEntry.js contains the full application code
- doesn't mention shared/singleton dependency negotiation
- assumes Module Federation gives compile-time type safety across the boundary
- can't describe what happens on a remote fetch failure