mirror of
https://github.com/lux-apps/papers.git
synced 2026-10-30 18:15:21 +00:00
zeekay
abf99d05fc
Restructured from flat .tex/.pdf files into per-paper subdirectories. Added Antje Worring as co-author on all papers. Synced PDFs to pdfs/ for download site.
71 lines
2.7 KiB
TeX
71 lines
2.7 KiB
TeX
\section{Motivation}
|
|
\label{sec:motivation}
|
|
%% ============================================================
|
|
|
|
\subsection{Per-Org SQLite as the Data Model}
|
|
|
|
Hanzo Base provisions one SQLite database per organization. A service
|
|
with 500 tenants has 500 database files. This is deliberate:
|
|
|
|
\begin{itemize}[nosep]
|
|
\item \textbf{Tenant isolation}: No query can accidentally cross org
|
|
boundaries. There is no \texttt{WHERE org\_id = ?} to forget.
|
|
\item \textbf{Atomic operations}: Backup, restore, migrate, and
|
|
delete are file operations, not multi-table transactions.
|
|
\item \textbf{Performance}: Each org's database fits in memory. No
|
|
shared lock contention across tenants.
|
|
\item \textbf{Portability}: An org can export its entire database as
|
|
a single encrypted file.
|
|
\end{itemize}
|
|
|
|
\subsection{Pod Ephemerality}
|
|
|
|
Kubernetes pods restart for routine reasons: node upgrades, autoscaler
|
|
rebalancing, OOM kills, deployment rollouts, spot instance preemption.
|
|
A StatefulSet with a PVC survives restarts on the same node but fails
|
|
on cross-node rescheduling if the volume cannot follow. Cloud provider
|
|
PVCs have documented failure modes:
|
|
|
|
\begin{table}[H]
|
|
\centering
|
|
\caption{PVC failure modes by provider.}
|
|
\label{tab:pvc-failures}
|
|
\begin{tabular}{@{}llp{6.5cm}@{}}
|
|
\toprule
|
|
\textbf{Provider} & \textbf{Volume Type} & \textbf{Failure Mode} \\
|
|
\midrule
|
|
GCP & PD-SSD & Detach hangs during live migration; pod stuck in
|
|
\texttt{ContainerCreating} for up to 6 minutes. \\
|
|
AWS & gp3 / io2 & AZ-pinned; cross-AZ reschedule requires manual
|
|
snapshot + restore. \\
|
|
DO & Block Storage & Single-attach; evicted pod blocks replacement pod
|
|
until force-detach timeout (5\,min default). \\
|
|
Bare metal & Local SSD & Node failure = total loss. No reattach. \\
|
|
\bottomrule
|
|
\end{tabular}
|
|
\end{table}
|
|
|
|
For a regulated securities platform, a 6-minute outage is acceptable
|
|
only if zero data is lost. PVCs alone do not guarantee this.
|
|
|
|
\subsection{Why Not PostgreSQL?}
|
|
|
|
PostgreSQL solves durability through streaming replication, but at the
|
|
cost of:
|
|
|
|
\begin{itemize}[nosep]
|
|
\item A shared database server that must be highly available itself.
|
|
\item Multi-tenant query scoping (\texttt{WHERE org\_id = ?}) on
|
|
every query, which is the \#1 source of data leaks.
|
|
\item Connection pool management, vacuum tuning, and schema migration
|
|
coordination across tenants.
|
|
\item Operational complexity disproportionate to the workload (most
|
|
org databases are under 100\,MB).
|
|
\end{itemize}
|
|
|
|
Per-org SQLite with encrypted replication provides the durability of
|
|
PostgreSQL streaming replication with the isolation guarantees and
|
|
operational simplicity of file-per-tenant.
|
|
|
|
%% ============================================================
|