fuse VS tigerbeetle

For this first implementation I used Go. After a reviewing some solutions I decided to use https://github.com/bazil/fuse. It seemed to be the easiest way to prototype.

Often, the SQLite database would fit in RAM, and reads would be served straight from the page cache, with no overhead.

Disclaimer: I wrote the FUSE framework LiteFS uses, https://bazil.org/fuse -- and I also have some pending performance-related work to finish, there...

I'd love to upgrade but I rely on mounting my Google Drive via /dev/fuse and rclone. There was a post yesterday saying that is broken in 13.1-RELEASE and linking to a FreeBSD bug which links to a rclone bug which links to a bazil bug which seems to have no traction. Someone mentioned a commandline utility that can interact with gdrive but this seems like a pretty bad replacement. IIUC the FreeBSD devs' theory is that a new async system call path exposed a bug in rclone and the blame is there. Anyway, I'm still on 13.0 for now, unfortunately.

This was also reported to rclone where someone pointed out that the problem is with fuse lib on FreeBSD and as such is a FreeBSD fuse lib porting problem.

> 'failed' state and the process itself leaving the accounting tables.

Once again, that cannot be done until the parent process consumes the exit status. That's what the zombie is there for. Zombies don't take up much space.

> Stuck mounts have a half solution (lazy unmounts) but even _that_ interface really also needs a timeout value after which operations on the target should be assumed to fail rather than return correctly.

These days most NFS etc mounts are "soft mounts", that is operations will eventually time out.

Lazy unmount doesn't really apply here, it makes the mountpoint disappear from the global namespace, but all existing open files remain untouched, and the mount lives as long as anything is still using it; it just removes the "entry point" to the mount.

On today's Linux, it's up to each filesystem to provide abort/timeout mechanism. For timeouts, this is the right design, as demonstrated by macOS complications with FUSE. I do wish there was a common way to make things abort.

There was a patch in circulation a long time ago, that could seamlessly switch all open FDs of any given mountpoint into a whole different filesystem named badfs. badfs would just return an error on any operation. As far as I know, that patch never got merged, probably because nobody ever got it working 100%.

That kind of a DoS would require a local attacker, and then the victim to access a mountpoint owned by the attacker. Using FUSE, you could get a lot of processes hanging like that, for sure. I guess you could trap a mail delivery agent, if you still had a system where mail was delivered to users' home directories.

However, forcibly aborting any FUSE mount is a single `echo 1 >/sys/fs/fuse/connection/NNNN/abort`, the only challenge is finding the right ID. (See https://github.com/bazil/fuse/blob/fb710f7dfd05053a3bc9516dd...)

Indeed!

I was so glad to see you cite not only the Rebello paper but also Protocol-Aware Recovery for Consensus-Based Storage. When I read your first comment, I was about to reply to mention PAR, and then saw you had saved me the trouble!

UW-Madison are truly the vanguard where consensus hits the disk.

We implemented Protocol-Aware Recovery for TigerBeetle [1], and I did a talk recently at the Recurse Center diving into PAR, talking about the intersection of global consensus protocol and local storage engine. It's called Let's Remix Distributed Database Design! [2] and owes the big ideas to UW-Madison.

[1] https://github.com/coilhq/tigerbeetle

[2] https://www.youtube.com/watch?v=rNmZZLant9o

> It sounds like payments might be part of the larger concept of declarative programming (DP)

Yes, exactly! The idea with TigerBeetle's state machine [1] is to expose double-entry accounting as higher level financial primitives, so that developers can think in terms of declaring transfers from one account to another. The business logic behind the scenes is detailed, but the interfaces and data structures are simple.

[1] https://github.com/coilhq/tigerbeetle/blob/main/src/state_ma...

> Maybe TigerBeetle could be generalized to support any multi-step distributed process?

That's part of the plan, that the distributed database framework of TigerBeetle can be used as a ”distributed Iron Man suit” to support any kind of state machine.

It's a pleasure. Let me know if you have any more questions about TigerBeetle. Our design doc is also here: https://github.com/coilhq/tigerbeetle/blob/main/docs/DESIGN....

Surprisingly, some of the most powerful distributed systems algorithms or tools are actually deterministic. They're powerful because they can "load the dice" and so make the distributed system more intuitive for humans to reason about, more resilient to real world network faults, and do all this with more performance.

For example, Barbara Liskov and James Cowling's deterministic view change [1], which isn't plagued by the latency issues of RAFT's randomized dueling leader problem. Viewstamped Replication Revisited's deterministic view change can react to a failed primary much quicker than RAFT (heartbeat timeouts don't require randomized "padding" as they do in RAFT), commence the leader election, and also ensure that the leader election succeeds without a split vote.

Determinism makes all that possible.

Deterministic testing [2][3] is also your best friend when it comes to testing distributed systems.

[1] I did a talk on VSR, including the benefits of the view change — https://www.youtube.com/watch?v=Wii1LX_ltIs

[2] FoundationDB are pioneers of deterministic testing — https://www.youtube.com/watch?v=OJb8A6h9jQQ

[3] TigerBeetle's deterministic simulation tests — https://github.com/coilhq/tigerbeetle#simulation-tests

This is the chasm problem, where people don't use a technology because people aren't using that technology, thus the technology has difficulty gaining adoption. I did see that Zig does have it's own killer app and startup that's using Zig: TigerBeattle.

Control flow statements should always be on their own lines, then it's easy to find all of them by visually scanning top-down, without needing to look all the way down each line.

[1]: https://github.com/coilhq/tigerbeetle/blob/main/src/vsr/repl...

> In hindsight, data logic should be in the database itself.

This is the reason we are creating TigerBeetle [1] at Coil, as an open source distributed financial accounting database, with the double entry logic and financial invariants enforced through financial primitives within the database itself.

This is all the more critical for financial data, because raw data consistency is not enough for financial transactions, you also need financial consistency, not to mention immutability.

The performance of doing it this way is also easier. For example, around a million financial transactions per second on commodity hardware, with p100 latency around 10-20ms.

[1] https://github.com/coilhq/tigerbeetle

You probably already know this — because we’ve mentioned it a few times — but Coil champions and supports open-source projects and is privacy-first, by default. Over the years, Developer Relations at Coil has championed and sponsored teams that write Open Web Documentations and projects that empower open-source developers to get paid. Coil has also incubated many open-source projects like Tigerbeetle and Rafiki.

[6] Partial logical sector reads/writes even when using O_DIRECT — https://github.com/coilhq/tigerbeetle/blob/main/src/storage....