paper

Tardigrade: Leveraging Lightweight Virtual Machines to Easily and Efficiently Construct Fault-Tolerant Services

  • Authors:
Read the paper

📜 Abstract

Many services need to survive machine failures, but designing and deploying fault-tolerant services can be difficult and error-prone. In this work, we present Tardigrade, a system that deploys an existing, unmodified binary as a fault-tolerant service. Tardigrade replicates the service on several machines so that it continues running even when some of them fail. Yet, it keeps the service states synchronized so clients see strongly consistent results. To achieve this efficiently, we use lightweight virtual machine replication. A lightweight virtual machine is a process sandboxed so that its external dependencies are completely encapsulated, enabling it to be migrated across machines. To let unmodified binaries run within such a sandbox, the sandbox also contains a library OS providing the expected API. We evaluate Tardigrade’s performance and demonstrate its applicability to a variety of services, showing that it can convert these services into fault-tolerant ones transparently and efficiently.

✨ Summary

Summary

  • The paper introduces asynchronous lightweight virtual-machine replication (LVMR), which replicates application state without replicating the full operating-system environment. By using lightweight VMs backed by a library OS, Tardigrade reduces checkpoint size, replication bandwidth, and checkpointing latency compared with traditional VM replication. (usenix.org)
  • Tardigrade interposes on the lightweight VM’s guest–host interface to track memory, files, threads, synchronization objects, and other state needed for portable checkpoints. It uses incremental checkpoints, dirty-page tracking, in-memory checkpointing, delta encoding, and checkpoint capping to control overhead. Primary-backup replication and a variant of Vertical Paxos provide failover and strong externally visible consistency. (usenix.org)
  • The implementation replicated the FDS metadata service, a ZooKeeper-compatible service, and Apache/MediaWiki without modifying their binaries. The evaluation found that performance depends strongly on workload characteristics: low or moderate state-mutation rates are suitable, while garbage collection, heavy memory dirtying, and database-style workloads can produce substantial latency and checkpoint costs. (usenix.org)
  • The central systems contribution is demonstrating that virtualization-layer replication can add fault tolerance to existing services with little or no application-level development effort, while also identifying the performance limits and service classes for which the approach is practical.

Subsequent influence

The quick search did not identify a clearly documented academic system that directly extends LVMR. A concrete industry connection is Microsoft’s later Project Tardigrade, an Azure platform-resiliency initiative that preserves virtual-machine state while recovering the host operating system from certain failures. Microsoft does not explicitly state that this production initiative implements the paper’s LVMR design, so the relationship should be treated as related rather than proven direct adoption. (azure.microsoft.com)