| 文件 | 最后提交记录 | 最后更新时间 |
|---|---|---|
v0.1.0 Load shedding is rebuilt. The resident-cell limit is now a hard cap enforced at admission, and pressure shedding is driven by RSS and CPU alone. RSS shedding is on by default at 80% of available memory (the cgroup limit in containers); set CELLD_MAX_RSS_MB to pin the ceiling, or 0 to disable. A full node declines new placements instead of evicting a resident, one queued placement costs at most one eviction, and a walk-down that stops returning memory halts instead of emptying the node. CELLD_RESIDENT_LOW_WATER is now ignored. Proxied responses stream between nodes; a truncated upstream body aborts the read instead of buffering into an error. The replicator seeds its position at activation, ending a listing storm on rate-limited stores. macOS nodes report real memory usage. celld is relicensed Apache-2.0. | 2 个月前 | |
v0.2.0 celld v0.2.0 changes three foundations: how cells share memory, how their state replicates, and how a fleet stays available when its object store fails or slows. Isolates and memory: - Resident cells share isolates and run turn by turn on a shared pool. v0.1.0 held one OS thread and one isolate for each cell. - A resident cell costs ~471 KB against ~3.4 MB in v0.1.0, measured linear to 2,500 resident cells (~1.2 GB) on one node. Memory no longer limits the resident population; admission and RSS shedding set the limit. - A handler that awaits I/O releases its isolate between turns, so co-resident cells cannot stall each other. - celld reclaims empty cell heaps and reuses retired isolate slots, so a long-lived node cannot leak isolates. - jemalloc is the global allocator. Two listeners: - celld now separates the data plane from the control plane. The public listener (--listen) serves only your Worker's routes and /__celld/health. A new internal listener (--internal-listen) carries everything else: the operator API (/state, /shutdown) and all node-to-node peer traffic. Keep the internal port on a private network. - A public listener on a non-loopback address requires an explicit internal listener. --advertise names the internal address, and celld diagnose probes peers at that address. Replication and compaction: - celld compacts many small level-0 replication objects into additive level-1 blocks (LTX v0.5.2 block format). Compaction is on by default and never deletes a source object. - A takeover of a write-heavy cell reads tens of objects instead of thousands. In one measured case, a cell with 4,096 durable writes restored from 42 objects and 0.6 MB instead of 4,116 objects and 19 MB, 3.8 times faster. - A restore downloads the objects in its plan concurrently, under one ceiling for the whole node. - A takeover pins the exact point in the replicated history that it restored from. celld never restores data that a fenced former owner uploads after that point, so a cell's history cannot fork and a failed write cannot reappear after a failover. - Compaction runs off the request path with a bounded duty cycle. A node that restarts with a large uncompacted backlog drains it without blocking durable writes. - celld and Litestream v0.5.16 can read both block and frame files. Litestream v0.5.11 can read only frame files. Availability under storage faults: - The time that remains on the last renewed lease bounds each lease renewal attempt, so one hung conditional write can no longer use the whole authority window. In a test that silently dropped all established storage connections for 20 seconds, a v0.1.0-class node fenced; a v0.2.0 node kept serving. - The core event loop owns the lease timer on a dedicated thread. Restores, compaction, and diagnostics cannot delay it. - celld logs each lease attempt at start and at completion, so a storage hang is distinguishable from a timer failure. Shutdown and restart: - SIGTERM starts a graceful drain. The drain hands each cell to a peer directly, so takeover does not wait for the lease TTL. - POST /shutdown?handoff=preserve on the internal listener prepares a same-node restart. The replacement process resumes its local cell databases and performs no owner or replica reads. - The drain waits for its ownership release writes and bounds each connection, so one idle connection cannot use the full deadline. - The process exits without unwinding. This fixes a crash when a warm node stops. Storage backends: - A gs:// bucket selects Cloud Storage's generation-based compare-and-swap and authenticates with Application Default Credentials. - A bucket can take a key prefix, so several independent fleets can share one bucket without collisions. Workers surface: - Wasm modules deploy and load as compiled WebAssembly.Module values. A workers-rs example shows the path, and older nodes refuse the new wasm-v1 deployment feature at deploy time. - A new RPC example exercises entrypoints, callbacks, RpcTarget returns, and promise pipelining end to end. Cross-isolate stubs remain limited to single method calls on named entrypoints. - Web Crypto and node:crypto expand: asymmetric import and export (SPKI, PKCS#8, JWK, PEM), generateKey, P-384 and P-521, Ed25519 and X25519, ECDH derivation, AES-CBC and AES-CTR, DigestStream, timingSafeEqual, and one-shot sign and verify. - setWebSocketAutoResponse answers ping-style messages without waking the cell. OpenTelemetry support (off by default): - CELLD_OTEL=1 turns on OpenTelemetry traces and logs with no collector required: celld writes them directly to the bucket as Parquet under a telemetry/ prefix, and DuckDB can query them. - A standard OTLP/HTTP collector is the alternative sink (CELLD_OTEL_SINK=otlp), and the usual OTEL_* variables apply. - W3C trace context propagates end to end: celld adopts an inbound traceparent, and fetch spans, cell dispatch, and console logs join the caller's trace. Overload: - A stateless request that finds every slot held now waits, bounded by CELLD_ADMISSION_WAIT_MS, instead of an immediate refusal. At overload, the node no longer spends its capacity on refusals. - CPU-based shedding is removed. RSS shedding (on by default since v0.1.0) is the only pressure trigger. Configuration: - celld validates every variable at startup, and an invalid value stops startup. Boolean variables accept only 0 or 1. - Removed: CELLD_WORKERS, CELLD_MAX_COHOSTED, CELLD_MAX_CPU_PERCENT, CELLD_RESIDENT_LOW_WATER (ignored since v0.1.0), CELLD_VALIDATE, and the /js route. - Renamed: CELLD_HIBERNATIONS is now CELLD_EVICTIONS. - Changed: CELLD_IDLE_EVICT_S no longer defaults to 300; idle eviction is off unless set. CELLD_UNSAFE_PUBLIC_ADVERTISE takes 1, not on. - Added, among others: CELLD_INTERNAL_ADDR, CELLD_MAX_STATELESS_ISOLATES, CELLD_ADMISSION_WAIT_MS, CELLD_LTX_COMPACTION, CELLD_SHUTDOWN_DRAIN_MS, and the CELLD_OTEL family. Upgrading from v0.1.0: - A v0.1.0 command line with a non-loopback --listen refuses to start until an explicit --internal-listen is added. - The upgrade must not be a rolling update: stop every v0.1.0 node, then start the v0.2.0 nodes. v0.2.0 advertises the internal listener, which v0.1.0 peers cannot follow, and writes compacted block objects, which a v0.1.0 reader cannot restore. A fleet must not mix the two versions. Co-authored-by: Nathan Whitaker <nathan@deno.com> Co-authored-by: Connor Hindley <conn.hindley@gmail.com> Co-authored-by: Yusuke Tanaka <yusuktan@maguro.dev> Co-authored-by: Heyang Zhou <hello@su3.io> Co-authored-by: Daniel Lee <danielylee@google.com> | 2 个月前 | |
v0.2.0 celld v0.2.0 changes three foundations: how cells share memory, how their state replicates, and how a fleet stays available when its object store fails or slows. Isolates and memory: - Resident cells share isolates and run turn by turn on a shared pool. v0.1.0 held one OS thread and one isolate for each cell. - A resident cell costs ~471 KB against ~3.4 MB in v0.1.0, measured linear to 2,500 resident cells (~1.2 GB) on one node. Memory no longer limits the resident population; admission and RSS shedding set the limit. - A handler that awaits I/O releases its isolate between turns, so co-resident cells cannot stall each other. - celld reclaims empty cell heaps and reuses retired isolate slots, so a long-lived node cannot leak isolates. - jemalloc is the global allocator. Two listeners: - celld now separates the data plane from the control plane. The public listener (--listen) serves only your Worker's routes and /__celld/health. A new internal listener (--internal-listen) carries everything else: the operator API (/state, /shutdown) and all node-to-node peer traffic. Keep the internal port on a private network. - A public listener on a non-loopback address requires an explicit internal listener. --advertise names the internal address, and celld diagnose probes peers at that address. Replication and compaction: - celld compacts many small level-0 replication objects into additive level-1 blocks (LTX v0.5.2 block format). Compaction is on by default and never deletes a source object. - A takeover of a write-heavy cell reads tens of objects instead of thousands. In one measured case, a cell with 4,096 durable writes restored from 42 objects and 0.6 MB instead of 4,116 objects and 19 MB, 3.8 times faster. - A restore downloads the objects in its plan concurrently, under one ceiling for the whole node. - A takeover pins the exact point in the replicated history that it restored from. celld never restores data that a fenced former owner uploads after that point, so a cell's history cannot fork and a failed write cannot reappear after a failover. - Compaction runs off the request path with a bounded duty cycle. A node that restarts with a large uncompacted backlog drains it without blocking durable writes. - celld and Litestream v0.5.16 can read both block and frame files. Litestream v0.5.11 can read only frame files. Availability under storage faults: - The time that remains on the last renewed lease bounds each lease renewal attempt, so one hung conditional write can no longer use the whole authority window. In a test that silently dropped all established storage connections for 20 seconds, a v0.1.0-class node fenced; a v0.2.0 node kept serving. - The core event loop owns the lease timer on a dedicated thread. Restores, compaction, and diagnostics cannot delay it. - celld logs each lease attempt at start and at completion, so a storage hang is distinguishable from a timer failure. Shutdown and restart: - SIGTERM starts a graceful drain. The drain hands each cell to a peer directly, so takeover does not wait for the lease TTL. - POST /shutdown?handoff=preserve on the internal listener prepares a same-node restart. The replacement process resumes its local cell databases and performs no owner or replica reads. - The drain waits for its ownership release writes and bounds each connection, so one idle connection cannot use the full deadline. - The process exits without unwinding. This fixes a crash when a warm node stops. Storage backends: - A gs:// bucket selects Cloud Storage's generation-based compare-and-swap and authenticates with Application Default Credentials. - A bucket can take a key prefix, so several independent fleets can share one bucket without collisions. Workers surface: - Wasm modules deploy and load as compiled WebAssembly.Module values. A workers-rs example shows the path, and older nodes refuse the new wasm-v1 deployment feature at deploy time. - A new RPC example exercises entrypoints, callbacks, RpcTarget returns, and promise pipelining end to end. Cross-isolate stubs remain limited to single method calls on named entrypoints. - Web Crypto and node:crypto expand: asymmetric import and export (SPKI, PKCS#8, JWK, PEM), generateKey, P-384 and P-521, Ed25519 and X25519, ECDH derivation, AES-CBC and AES-CTR, DigestStream, timingSafeEqual, and one-shot sign and verify. - setWebSocketAutoResponse answers ping-style messages without waking the cell. OpenTelemetry support (off by default): - CELLD_OTEL=1 turns on OpenTelemetry traces and logs with no collector required: celld writes them directly to the bucket as Parquet under a telemetry/ prefix, and DuckDB can query them. - A standard OTLP/HTTP collector is the alternative sink (CELLD_OTEL_SINK=otlp), and the usual OTEL_* variables apply. - W3C trace context propagates end to end: celld adopts an inbound traceparent, and fetch spans, cell dispatch, and console logs join the caller's trace. Overload: - A stateless request that finds every slot held now waits, bounded by CELLD_ADMISSION_WAIT_MS, instead of an immediate refusal. At overload, the node no longer spends its capacity on refusals. - CPU-based shedding is removed. RSS shedding (on by default since v0.1.0) is the only pressure trigger. Configuration: - celld validates every variable at startup, and an invalid value stops startup. Boolean variables accept only 0 or 1. - Removed: CELLD_WORKERS, CELLD_MAX_COHOSTED, CELLD_MAX_CPU_PERCENT, CELLD_RESIDENT_LOW_WATER (ignored since v0.1.0), CELLD_VALIDATE, and the /js route. - Renamed: CELLD_HIBERNATIONS is now CELLD_EVICTIONS. - Changed: CELLD_IDLE_EVICT_S no longer defaults to 300; idle eviction is off unless set. CELLD_UNSAFE_PUBLIC_ADVERTISE takes 1, not on. - Added, among others: CELLD_INTERNAL_ADDR, CELLD_MAX_STATELESS_ISOLATES, CELLD_ADMISSION_WAIT_MS, CELLD_LTX_COMPACTION, CELLD_SHUTDOWN_DRAIN_MS, and the CELLD_OTEL family. Upgrading from v0.1.0: - A v0.1.0 command line with a non-loopback --listen refuses to start until an explicit --internal-listen is added. - The upgrade must not be a rolling update: stop every v0.1.0 node, then start the v0.2.0 nodes. v0.2.0 advertises the internal listener, which v0.1.0 peers cannot follow, and writes compacted block objects, which a v0.1.0 reader cannot restore. A fleet must not mix the two versions. Co-authored-by: Nathan Whitaker <nathan@deno.com> Co-authored-by: Connor Hindley <conn.hindley@gmail.com> Co-authored-by: Yusuke Tanaka <yusuktan@maguro.dev> Co-authored-by: Heyang Zhou <hello@su3.io> Co-authored-by: Daniel Lee <danielylee@google.com> | 2 个月前 | |
v0.1.0 Load shedding is rebuilt. The resident-cell limit is now a hard cap enforced at admission, and pressure shedding is driven by RSS and CPU alone. RSS shedding is on by default at 80% of available memory (the cgroup limit in containers); set CELLD_MAX_RSS_MB to pin the ceiling, or 0 to disable. A full node declines new placements instead of evicting a resident, one queued placement costs at most one eviction, and a walk-down that stops returning memory halts instead of emptying the node. CELLD_RESIDENT_LOW_WATER is now ignored. Proxied responses stream between nodes; a truncated upstream body aborts the read instead of buffering into an error. The replicator seeds its position at activation, ending a listing storm on rate-limited stores. macOS nodes report real memory usage. celld is relicensed Apache-2.0. | 2 个月前 | |
v0.2.0 celld v0.2.0 changes three foundations: how cells share memory, how their state replicates, and how a fleet stays available when its object store fails or slows. Isolates and memory: - Resident cells share isolates and run turn by turn on a shared pool. v0.1.0 held one OS thread and one isolate for each cell. - A resident cell costs ~471 KB against ~3.4 MB in v0.1.0, measured linear to 2,500 resident cells (~1.2 GB) on one node. Memory no longer limits the resident population; admission and RSS shedding set the limit. - A handler that awaits I/O releases its isolate between turns, so co-resident cells cannot stall each other. - celld reclaims empty cell heaps and reuses retired isolate slots, so a long-lived node cannot leak isolates. - jemalloc is the global allocator. Two listeners: - celld now separates the data plane from the control plane. The public listener (--listen) serves only your Worker's routes and /__celld/health. A new internal listener (--internal-listen) carries everything else: the operator API (/state, /shutdown) and all node-to-node peer traffic. Keep the internal port on a private network. - A public listener on a non-loopback address requires an explicit internal listener. --advertise names the internal address, and celld diagnose probes peers at that address. Replication and compaction: - celld compacts many small level-0 replication objects into additive level-1 blocks (LTX v0.5.2 block format). Compaction is on by default and never deletes a source object. - A takeover of a write-heavy cell reads tens of objects instead of thousands. In one measured case, a cell with 4,096 durable writes restored from 42 objects and 0.6 MB instead of 4,116 objects and 19 MB, 3.8 times faster. - A restore downloads the objects in its plan concurrently, under one ceiling for the whole node. - A takeover pins the exact point in the replicated history that it restored from. celld never restores data that a fenced former owner uploads after that point, so a cell's history cannot fork and a failed write cannot reappear after a failover. - Compaction runs off the request path with a bounded duty cycle. A node that restarts with a large uncompacted backlog drains it without blocking durable writes. - celld and Litestream v0.5.16 can read both block and frame files. Litestream v0.5.11 can read only frame files. Availability under storage faults: - The time that remains on the last renewed lease bounds each lease renewal attempt, so one hung conditional write can no longer use the whole authority window. In a test that silently dropped all established storage connections for 20 seconds, a v0.1.0-class node fenced; a v0.2.0 node kept serving. - The core event loop owns the lease timer on a dedicated thread. Restores, compaction, and diagnostics cannot delay it. - celld logs each lease attempt at start and at completion, so a storage hang is distinguishable from a timer failure. Shutdown and restart: - SIGTERM starts a graceful drain. The drain hands each cell to a peer directly, so takeover does not wait for the lease TTL. - POST /shutdown?handoff=preserve on the internal listener prepares a same-node restart. The replacement process resumes its local cell databases and performs no owner or replica reads. - The drain waits for its ownership release writes and bounds each connection, so one idle connection cannot use the full deadline. - The process exits without unwinding. This fixes a crash when a warm node stops. Storage backends: - A gs:// bucket selects Cloud Storage's generation-based compare-and-swap and authenticates with Application Default Credentials. - A bucket can take a key prefix, so several independent fleets can share one bucket without collisions. Workers surface: - Wasm modules deploy and load as compiled WebAssembly.Module values. A workers-rs example shows the path, and older nodes refuse the new wasm-v1 deployment feature at deploy time. - A new RPC example exercises entrypoints, callbacks, RpcTarget returns, and promise pipelining end to end. Cross-isolate stubs remain limited to single method calls on named entrypoints. - Web Crypto and node:crypto expand: asymmetric import and export (SPKI, PKCS#8, JWK, PEM), generateKey, P-384 and P-521, Ed25519 and X25519, ECDH derivation, AES-CBC and AES-CTR, DigestStream, timingSafeEqual, and one-shot sign and verify. - setWebSocketAutoResponse answers ping-style messages without waking the cell. OpenTelemetry support (off by default): - CELLD_OTEL=1 turns on OpenTelemetry traces and logs with no collector required: celld writes them directly to the bucket as Parquet under a telemetry/ prefix, and DuckDB can query them. - A standard OTLP/HTTP collector is the alternative sink (CELLD_OTEL_SINK=otlp), and the usual OTEL_* variables apply. - W3C trace context propagates end to end: celld adopts an inbound traceparent, and fetch spans, cell dispatch, and console logs join the caller's trace. Overload: - A stateless request that finds every slot held now waits, bounded by CELLD_ADMISSION_WAIT_MS, instead of an immediate refusal. At overload, the node no longer spends its capacity on refusals. - CPU-based shedding is removed. RSS shedding (on by default since v0.1.0) is the only pressure trigger. Configuration: - celld validates every variable at startup, and an invalid value stops startup. Boolean variables accept only 0 or 1. - Removed: CELLD_WORKERS, CELLD_MAX_COHOSTED, CELLD_MAX_CPU_PERCENT, CELLD_RESIDENT_LOW_WATER (ignored since v0.1.0), CELLD_VALIDATE, and the /js route. - Renamed: CELLD_HIBERNATIONS is now CELLD_EVICTIONS. - Changed: CELLD_IDLE_EVICT_S no longer defaults to 300; idle eviction is off unless set. CELLD_UNSAFE_PUBLIC_ADVERTISE takes 1, not on. - Added, among others: CELLD_INTERNAL_ADDR, CELLD_MAX_STATELESS_ISOLATES, CELLD_ADMISSION_WAIT_MS, CELLD_LTX_COMPACTION, CELLD_SHUTDOWN_DRAIN_MS, and the CELLD_OTEL family. Upgrading from v0.1.0: - A v0.1.0 command line with a non-loopback --listen refuses to start until an explicit --internal-listen is added. - The upgrade must not be a rolling update: stop every v0.1.0 node, then start the v0.2.0 nodes. v0.2.0 advertises the internal listener, which v0.1.0 peers cannot follow, and writes compacted block objects, which a v0.1.0 reader cannot restore. A fleet must not mix the two versions. Co-authored-by: Nathan Whitaker <nathan@deno.com> Co-authored-by: Connor Hindley <conn.hindley@gmail.com> Co-authored-by: Yusuke Tanaka <yusuktan@maguro.dev> Co-authored-by: Heyang Zhou <hello@su3.io> Co-authored-by: Daniel Lee <danielylee@google.com> | 2 个月前 | |
v0.2.0 celld v0.2.0 changes three foundations: how cells share memory, how their state replicates, and how a fleet stays available when its object store fails or slows. Isolates and memory: - Resident cells share isolates and run turn by turn on a shared pool. v0.1.0 held one OS thread and one isolate for each cell. - A resident cell costs ~471 KB against ~3.4 MB in v0.1.0, measured linear to 2,500 resident cells (~1.2 GB) on one node. Memory no longer limits the resident population; admission and RSS shedding set the limit. - A handler that awaits I/O releases its isolate between turns, so co-resident cells cannot stall each other. - celld reclaims empty cell heaps and reuses retired isolate slots, so a long-lived node cannot leak isolates. - jemalloc is the global allocator. Two listeners: - celld now separates the data plane from the control plane. The public listener (--listen) serves only your Worker's routes and /__celld/health. A new internal listener (--internal-listen) carries everything else: the operator API (/state, /shutdown) and all node-to-node peer traffic. Keep the internal port on a private network. - A public listener on a non-loopback address requires an explicit internal listener. --advertise names the internal address, and celld diagnose probes peers at that address. Replication and compaction: - celld compacts many small level-0 replication objects into additive level-1 blocks (LTX v0.5.2 block format). Compaction is on by default and never deletes a source object. - A takeover of a write-heavy cell reads tens of objects instead of thousands. In one measured case, a cell with 4,096 durable writes restored from 42 objects and 0.6 MB instead of 4,116 objects and 19 MB, 3.8 times faster. - A restore downloads the objects in its plan concurrently, under one ceiling for the whole node. - A takeover pins the exact point in the replicated history that it restored from. celld never restores data that a fenced former owner uploads after that point, so a cell's history cannot fork and a failed write cannot reappear after a failover. - Compaction runs off the request path with a bounded duty cycle. A node that restarts with a large uncompacted backlog drains it without blocking durable writes. - celld and Litestream v0.5.16 can read both block and frame files. Litestream v0.5.11 can read only frame files. Availability under storage faults: - The time that remains on the last renewed lease bounds each lease renewal attempt, so one hung conditional write can no longer use the whole authority window. In a test that silently dropped all established storage connections for 20 seconds, a v0.1.0-class node fenced; a v0.2.0 node kept serving. - The core event loop owns the lease timer on a dedicated thread. Restores, compaction, and diagnostics cannot delay it. - celld logs each lease attempt at start and at completion, so a storage hang is distinguishable from a timer failure. Shutdown and restart: - SIGTERM starts a graceful drain. The drain hands each cell to a peer directly, so takeover does not wait for the lease TTL. - POST /shutdown?handoff=preserve on the internal listener prepares a same-node restart. The replacement process resumes its local cell databases and performs no owner or replica reads. - The drain waits for its ownership release writes and bounds each connection, so one idle connection cannot use the full deadline. - The process exits without unwinding. This fixes a crash when a warm node stops. Storage backends: - A gs:// bucket selects Cloud Storage's generation-based compare-and-swap and authenticates with Application Default Credentials. - A bucket can take a key prefix, so several independent fleets can share one bucket without collisions. Workers surface: - Wasm modules deploy and load as compiled WebAssembly.Module values. A workers-rs example shows the path, and older nodes refuse the new wasm-v1 deployment feature at deploy time. - A new RPC example exercises entrypoints, callbacks, RpcTarget returns, and promise pipelining end to end. Cross-isolate stubs remain limited to single method calls on named entrypoints. - Web Crypto and node:crypto expand: asymmetric import and export (SPKI, PKCS#8, JWK, PEM), generateKey, P-384 and P-521, Ed25519 and X25519, ECDH derivation, AES-CBC and AES-CTR, DigestStream, timingSafeEqual, and one-shot sign and verify. - setWebSocketAutoResponse answers ping-style messages without waking the cell. OpenTelemetry support (off by default): - CELLD_OTEL=1 turns on OpenTelemetry traces and logs with no collector required: celld writes them directly to the bucket as Parquet under a telemetry/ prefix, and DuckDB can query them. - A standard OTLP/HTTP collector is the alternative sink (CELLD_OTEL_SINK=otlp), and the usual OTEL_* variables apply. - W3C trace context propagates end to end: celld adopts an inbound traceparent, and fetch spans, cell dispatch, and console logs join the caller's trace. Overload: - A stateless request that finds every slot held now waits, bounded by CELLD_ADMISSION_WAIT_MS, instead of an immediate refusal. At overload, the node no longer spends its capacity on refusals. - CPU-based shedding is removed. RSS shedding (on by default since v0.1.0) is the only pressure trigger. Configuration: - celld validates every variable at startup, and an invalid value stops startup. Boolean variables accept only 0 or 1. - Removed: CELLD_WORKERS, CELLD_MAX_COHOSTED, CELLD_MAX_CPU_PERCENT, CELLD_RESIDENT_LOW_WATER (ignored since v0.1.0), CELLD_VALIDATE, and the /js route. - Renamed: CELLD_HIBERNATIONS is now CELLD_EVICTIONS. - Changed: CELLD_IDLE_EVICT_S no longer defaults to 300; idle eviction is off unless set. CELLD_UNSAFE_PUBLIC_ADVERTISE takes 1, not on. - Added, among others: CELLD_INTERNAL_ADDR, CELLD_MAX_STATELESS_ISOLATES, CELLD_ADMISSION_WAIT_MS, CELLD_LTX_COMPACTION, CELLD_SHUTDOWN_DRAIN_MS, and the CELLD_OTEL family. Upgrading from v0.1.0: - A v0.1.0 command line with a non-loopback --listen refuses to start until an explicit --internal-listen is added. - The upgrade must not be a rolling update: stop every v0.1.0 node, then start the v0.2.0 nodes. v0.2.0 advertises the internal listener, which v0.1.0 peers cannot follow, and writes compacted block objects, which a v0.1.0 reader cannot restore. A fleet must not mix the two versions. Co-authored-by: Nathan Whitaker <nathan@deno.com> Co-authored-by: Connor Hindley <conn.hindley@gmail.com> Co-authored-by: Yusuke Tanaka <yusuktan@maguro.dev> Co-authored-by: Heyang Zhou <hello@su3.io> Co-authored-by: Daniel Lee <danielylee@google.com> | 2 个月前 | |
v0.2.0 celld v0.2.0 changes three foundations: how cells share memory, how their state replicates, and how a fleet stays available when its object store fails or slows. Isolates and memory: - Resident cells share isolates and run turn by turn on a shared pool. v0.1.0 held one OS thread and one isolate for each cell. - A resident cell costs ~471 KB against ~3.4 MB in v0.1.0, measured linear to 2,500 resident cells (~1.2 GB) on one node. Memory no longer limits the resident population; admission and RSS shedding set the limit. - A handler that awaits I/O releases its isolate between turns, so co-resident cells cannot stall each other. - celld reclaims empty cell heaps and reuses retired isolate slots, so a long-lived node cannot leak isolates. - jemalloc is the global allocator. Two listeners: - celld now separates the data plane from the control plane. The public listener (--listen) serves only your Worker's routes and /__celld/health. A new internal listener (--internal-listen) carries everything else: the operator API (/state, /shutdown) and all node-to-node peer traffic. Keep the internal port on a private network. - A public listener on a non-loopback address requires an explicit internal listener. --advertise names the internal address, and celld diagnose probes peers at that address. Replication and compaction: - celld compacts many small level-0 replication objects into additive level-1 blocks (LTX v0.5.2 block format). Compaction is on by default and never deletes a source object. - A takeover of a write-heavy cell reads tens of objects instead of thousands. In one measured case, a cell with 4,096 durable writes restored from 42 objects and 0.6 MB instead of 4,116 objects and 19 MB, 3.8 times faster. - A restore downloads the objects in its plan concurrently, under one ceiling for the whole node. - A takeover pins the exact point in the replicated history that it restored from. celld never restores data that a fenced former owner uploads after that point, so a cell's history cannot fork and a failed write cannot reappear after a failover. - Compaction runs off the request path with a bounded duty cycle. A node that restarts with a large uncompacted backlog drains it without blocking durable writes. - celld and Litestream v0.5.16 can read both block and frame files. Litestream v0.5.11 can read only frame files. Availability under storage faults: - The time that remains on the last renewed lease bounds each lease renewal attempt, so one hung conditional write can no longer use the whole authority window. In a test that silently dropped all established storage connections for 20 seconds, a v0.1.0-class node fenced; a v0.2.0 node kept serving. - The core event loop owns the lease timer on a dedicated thread. Restores, compaction, and diagnostics cannot delay it. - celld logs each lease attempt at start and at completion, so a storage hang is distinguishable from a timer failure. Shutdown and restart: - SIGTERM starts a graceful drain. The drain hands each cell to a peer directly, so takeover does not wait for the lease TTL. - POST /shutdown?handoff=preserve on the internal listener prepares a same-node restart. The replacement process resumes its local cell databases and performs no owner or replica reads. - The drain waits for its ownership release writes and bounds each connection, so one idle connection cannot use the full deadline. - The process exits without unwinding. This fixes a crash when a warm node stops. Storage backends: - A gs:// bucket selects Cloud Storage's generation-based compare-and-swap and authenticates with Application Default Credentials. - A bucket can take a key prefix, so several independent fleets can share one bucket without collisions. Workers surface: - Wasm modules deploy and load as compiled WebAssembly.Module values. A workers-rs example shows the path, and older nodes refuse the new wasm-v1 deployment feature at deploy time. - A new RPC example exercises entrypoints, callbacks, RpcTarget returns, and promise pipelining end to end. Cross-isolate stubs remain limited to single method calls on named entrypoints. - Web Crypto and node:crypto expand: asymmetric import and export (SPKI, PKCS#8, JWK, PEM), generateKey, P-384 and P-521, Ed25519 and X25519, ECDH derivation, AES-CBC and AES-CTR, DigestStream, timingSafeEqual, and one-shot sign and verify. - setWebSocketAutoResponse answers ping-style messages without waking the cell. OpenTelemetry support (off by default): - CELLD_OTEL=1 turns on OpenTelemetry traces and logs with no collector required: celld writes them directly to the bucket as Parquet under a telemetry/ prefix, and DuckDB can query them. - A standard OTLP/HTTP collector is the alternative sink (CELLD_OTEL_SINK=otlp), and the usual OTEL_* variables apply. - W3C trace context propagates end to end: celld adopts an inbound traceparent, and fetch spans, cell dispatch, and console logs join the caller's trace. Overload: - A stateless request that finds every slot held now waits, bounded by CELLD_ADMISSION_WAIT_MS, instead of an immediate refusal. At overload, the node no longer spends its capacity on refusals. - CPU-based shedding is removed. RSS shedding (on by default since v0.1.0) is the only pressure trigger. Configuration: - celld validates every variable at startup, and an invalid value stops startup. Boolean variables accept only 0 or 1. - Removed: CELLD_WORKERS, CELLD_MAX_COHOSTED, CELLD_MAX_CPU_PERCENT, CELLD_RESIDENT_LOW_WATER (ignored since v0.1.0), CELLD_VALIDATE, and the /js route. - Renamed: CELLD_HIBERNATIONS is now CELLD_EVICTIONS. - Changed: CELLD_IDLE_EVICT_S no longer defaults to 300; idle eviction is off unless set. CELLD_UNSAFE_PUBLIC_ADVERTISE takes 1, not on. - Added, among others: CELLD_INTERNAL_ADDR, CELLD_MAX_STATELESS_ISOLATES, CELLD_ADMISSION_WAIT_MS, CELLD_LTX_COMPACTION, CELLD_SHUTDOWN_DRAIN_MS, and the CELLD_OTEL family. Upgrading from v0.1.0: - A v0.1.0 command line with a non-loopback --listen refuses to start until an explicit --internal-listen is added. - The upgrade must not be a rolling update: stop every v0.1.0 node, then start the v0.2.0 nodes. v0.2.0 advertises the internal listener, which v0.1.0 peers cannot follow, and writes compacted block objects, which a v0.1.0 reader cannot restore. A fleet must not mix the two versions. Co-authored-by: Nathan Whitaker <nathan@deno.com> Co-authored-by: Connor Hindley <conn.hindley@gmail.com> Co-authored-by: Yusuke Tanaka <yusuktan@maguro.dev> Co-authored-by: Heyang Zhou <hello@su3.io> Co-authored-by: Daniel Lee <danielylee@google.com> | 2 个月前 | |
v0.1.0 Load shedding is rebuilt. The resident-cell limit is now a hard cap enforced at admission, and pressure shedding is driven by RSS and CPU alone. RSS shedding is on by default at 80% of available memory (the cgroup limit in containers); set CELLD_MAX_RSS_MB to pin the ceiling, or 0 to disable. A full node declines new placements instead of evicting a resident, one queued placement costs at most one eviction, and a walk-down that stops returning memory halts instead of emptying the node. CELLD_RESIDENT_LOW_WATER is now ignored. Proxied responses stream between nodes; a truncated upstream body aborts the read instead of buffering into an error. The replicator seeds its position at activation, ending a listing storm on rate-limited stores. macOS nodes report real memory usage. celld is relicensed Apache-2.0. | 2 个月前 | |
v0.2.0 celld v0.2.0 changes three foundations: how cells share memory, how their state replicates, and how a fleet stays available when its object store fails or slows. Isolates and memory: - Resident cells share isolates and run turn by turn on a shared pool. v0.1.0 held one OS thread and one isolate for each cell. - A resident cell costs ~471 KB against ~3.4 MB in v0.1.0, measured linear to 2,500 resident cells (~1.2 GB) on one node. Memory no longer limits the resident population; admission and RSS shedding set the limit. - A handler that awaits I/O releases its isolate between turns, so co-resident cells cannot stall each other. - celld reclaims empty cell heaps and reuses retired isolate slots, so a long-lived node cannot leak isolates. - jemalloc is the global allocator. Two listeners: - celld now separates the data plane from the control plane. The public listener (--listen) serves only your Worker's routes and /__celld/health. A new internal listener (--internal-listen) carries everything else: the operator API (/state, /shutdown) and all node-to-node peer traffic. Keep the internal port on a private network. - A public listener on a non-loopback address requires an explicit internal listener. --advertise names the internal address, and celld diagnose probes peers at that address. Replication and compaction: - celld compacts many small level-0 replication objects into additive level-1 blocks (LTX v0.5.2 block format). Compaction is on by default and never deletes a source object. - A takeover of a write-heavy cell reads tens of objects instead of thousands. In one measured case, a cell with 4,096 durable writes restored from 42 objects and 0.6 MB instead of 4,116 objects and 19 MB, 3.8 times faster. - A restore downloads the objects in its plan concurrently, under one ceiling for the whole node. - A takeover pins the exact point in the replicated history that it restored from. celld never restores data that a fenced former owner uploads after that point, so a cell's history cannot fork and a failed write cannot reappear after a failover. - Compaction runs off the request path with a bounded duty cycle. A node that restarts with a large uncompacted backlog drains it without blocking durable writes. - celld and Litestream v0.5.16 can read both block and frame files. Litestream v0.5.11 can read only frame files. Availability under storage faults: - The time that remains on the last renewed lease bounds each lease renewal attempt, so one hung conditional write can no longer use the whole authority window. In a test that silently dropped all established storage connections for 20 seconds, a v0.1.0-class node fenced; a v0.2.0 node kept serving. - The core event loop owns the lease timer on a dedicated thread. Restores, compaction, and diagnostics cannot delay it. - celld logs each lease attempt at start and at completion, so a storage hang is distinguishable from a timer failure. Shutdown and restart: - SIGTERM starts a graceful drain. The drain hands each cell to a peer directly, so takeover does not wait for the lease TTL. - POST /shutdown?handoff=preserve on the internal listener prepares a same-node restart. The replacement process resumes its local cell databases and performs no owner or replica reads. - The drain waits for its ownership release writes and bounds each connection, so one idle connection cannot use the full deadline. - The process exits without unwinding. This fixes a crash when a warm node stops. Storage backends: - A gs:// bucket selects Cloud Storage's generation-based compare-and-swap and authenticates with Application Default Credentials. - A bucket can take a key prefix, so several independent fleets can share one bucket without collisions. Workers surface: - Wasm modules deploy and load as compiled WebAssembly.Module values. A workers-rs example shows the path, and older nodes refuse the new wasm-v1 deployment feature at deploy time. - A new RPC example exercises entrypoints, callbacks, RpcTarget returns, and promise pipelining end to end. Cross-isolate stubs remain limited to single method calls on named entrypoints. - Web Crypto and node:crypto expand: asymmetric import and export (SPKI, PKCS#8, JWK, PEM), generateKey, P-384 and P-521, Ed25519 and X25519, ECDH derivation, AES-CBC and AES-CTR, DigestStream, timingSafeEqual, and one-shot sign and verify. - setWebSocketAutoResponse answers ping-style messages without waking the cell. OpenTelemetry support (off by default): - CELLD_OTEL=1 turns on OpenTelemetry traces and logs with no collector required: celld writes them directly to the bucket as Parquet under a telemetry/ prefix, and DuckDB can query them. - A standard OTLP/HTTP collector is the alternative sink (CELLD_OTEL_SINK=otlp), and the usual OTEL_* variables apply. - W3C trace context propagates end to end: celld adopts an inbound traceparent, and fetch spans, cell dispatch, and console logs join the caller's trace. Overload: - A stateless request that finds every slot held now waits, bounded by CELLD_ADMISSION_WAIT_MS, instead of an immediate refusal. At overload, the node no longer spends its capacity on refusals. - CPU-based shedding is removed. RSS shedding (on by default since v0.1.0) is the only pressure trigger. Configuration: - celld validates every variable at startup, and an invalid value stops startup. Boolean variables accept only 0 or 1. - Removed: CELLD_WORKERS, CELLD_MAX_COHOSTED, CELLD_MAX_CPU_PERCENT, CELLD_RESIDENT_LOW_WATER (ignored since v0.1.0), CELLD_VALIDATE, and the /js route. - Renamed: CELLD_HIBERNATIONS is now CELLD_EVICTIONS. - Changed: CELLD_IDLE_EVICT_S no longer defaults to 300; idle eviction is off unless set. CELLD_UNSAFE_PUBLIC_ADVERTISE takes 1, not on. - Added, among others: CELLD_INTERNAL_ADDR, CELLD_MAX_STATELESS_ISOLATES, CELLD_ADMISSION_WAIT_MS, CELLD_LTX_COMPACTION, CELLD_SHUTDOWN_DRAIN_MS, and the CELLD_OTEL family. Upgrading from v0.1.0: - A v0.1.0 command line with a non-loopback --listen refuses to start until an explicit --internal-listen is added. - The upgrade must not be a rolling update: stop every v0.1.0 node, then start the v0.2.0 nodes. v0.2.0 advertises the internal listener, which v0.1.0 peers cannot follow, and writes compacted block objects, which a v0.1.0 reader cannot restore. A fleet must not mix the two versions. Co-authored-by: Nathan Whitaker <nathan@deno.com> Co-authored-by: Connor Hindley <conn.hindley@gmail.com> Co-authored-by: Yusuke Tanaka <yusuktan@maguro.dev> Co-authored-by: Heyang Zhou <hello@su3.io> Co-authored-by: Daniel Lee <danielylee@google.com> | 2 个月前 | |
v0.2.0 celld v0.2.0 changes three foundations: how cells share memory, how their state replicates, and how a fleet stays available when its object store fails or slows. Isolates and memory: - Resident cells share isolates and run turn by turn on a shared pool. v0.1.0 held one OS thread and one isolate for each cell. - A resident cell costs ~471 KB against ~3.4 MB in v0.1.0, measured linear to 2,500 resident cells (~1.2 GB) on one node. Memory no longer limits the resident population; admission and RSS shedding set the limit. - A handler that awaits I/O releases its isolate between turns, so co-resident cells cannot stall each other. - celld reclaims empty cell heaps and reuses retired isolate slots, so a long-lived node cannot leak isolates. - jemalloc is the global allocator. Two listeners: - celld now separates the data plane from the control plane. The public listener (--listen) serves only your Worker's routes and /__celld/health. A new internal listener (--internal-listen) carries everything else: the operator API (/state, /shutdown) and all node-to-node peer traffic. Keep the internal port on a private network. - A public listener on a non-loopback address requires an explicit internal listener. --advertise names the internal address, and celld diagnose probes peers at that address. Replication and compaction: - celld compacts many small level-0 replication objects into additive level-1 blocks (LTX v0.5.2 block format). Compaction is on by default and never deletes a source object. - A takeover of a write-heavy cell reads tens of objects instead of thousands. In one measured case, a cell with 4,096 durable writes restored from 42 objects and 0.6 MB instead of 4,116 objects and 19 MB, 3.8 times faster. - A restore downloads the objects in its plan concurrently, under one ceiling for the whole node. - A takeover pins the exact point in the replicated history that it restored from. celld never restores data that a fenced former owner uploads after that point, so a cell's history cannot fork and a failed write cannot reappear after a failover. - Compaction runs off the request path with a bounded duty cycle. A node that restarts with a large uncompacted backlog drains it without blocking durable writes. - celld and Litestream v0.5.16 can read both block and frame files. Litestream v0.5.11 can read only frame files. Availability under storage faults: - The time that remains on the last renewed lease bounds each lease renewal attempt, so one hung conditional write can no longer use the whole authority window. In a test that silently dropped all established storage connections for 20 seconds, a v0.1.0-class node fenced; a v0.2.0 node kept serving. - The core event loop owns the lease timer on a dedicated thread. Restores, compaction, and diagnostics cannot delay it. - celld logs each lease attempt at start and at completion, so a storage hang is distinguishable from a timer failure. Shutdown and restart: - SIGTERM starts a graceful drain. The drain hands each cell to a peer directly, so takeover does not wait for the lease TTL. - POST /shutdown?handoff=preserve on the internal listener prepares a same-node restart. The replacement process resumes its local cell databases and performs no owner or replica reads. - The drain waits for its ownership release writes and bounds each connection, so one idle connection cannot use the full deadline. - The process exits without unwinding. This fixes a crash when a warm node stops. Storage backends: - A gs:// bucket selects Cloud Storage's generation-based compare-and-swap and authenticates with Application Default Credentials. - A bucket can take a key prefix, so several independent fleets can share one bucket without collisions. Workers surface: - Wasm modules deploy and load as compiled WebAssembly.Module values. A workers-rs example shows the path, and older nodes refuse the new wasm-v1 deployment feature at deploy time. - A new RPC example exercises entrypoints, callbacks, RpcTarget returns, and promise pipelining end to end. Cross-isolate stubs remain limited to single method calls on named entrypoints. - Web Crypto and node:crypto expand: asymmetric import and export (SPKI, PKCS#8, JWK, PEM), generateKey, P-384 and P-521, Ed25519 and X25519, ECDH derivation, AES-CBC and AES-CTR, DigestStream, timingSafeEqual, and one-shot sign and verify. - setWebSocketAutoResponse answers ping-style messages without waking the cell. OpenTelemetry support (off by default): - CELLD_OTEL=1 turns on OpenTelemetry traces and logs with no collector required: celld writes them directly to the bucket as Parquet under a telemetry/ prefix, and DuckDB can query them. - A standard OTLP/HTTP collector is the alternative sink (CELLD_OTEL_SINK=otlp), and the usual OTEL_* variables apply. - W3C trace context propagates end to end: celld adopts an inbound traceparent, and fetch spans, cell dispatch, and console logs join the caller's trace. Overload: - A stateless request that finds every slot held now waits, bounded by CELLD_ADMISSION_WAIT_MS, instead of an immediate refusal. At overload, the node no longer spends its capacity on refusals. - CPU-based shedding is removed. RSS shedding (on by default since v0.1.0) is the only pressure trigger. Configuration: - celld validates every variable at startup, and an invalid value stops startup. Boolean variables accept only 0 or 1. - Removed: CELLD_WORKERS, CELLD_MAX_COHOSTED, CELLD_MAX_CPU_PERCENT, CELLD_RESIDENT_LOW_WATER (ignored since v0.1.0), CELLD_VALIDATE, and the /js route. - Renamed: CELLD_HIBERNATIONS is now CELLD_EVICTIONS. - Changed: CELLD_IDLE_EVICT_S no longer defaults to 300; idle eviction is off unless set. CELLD_UNSAFE_PUBLIC_ADVERTISE takes 1, not on. - Added, among others: CELLD_INTERNAL_ADDR, CELLD_MAX_STATELESS_ISOLATES, CELLD_ADMISSION_WAIT_MS, CELLD_LTX_COMPACTION, CELLD_SHUTDOWN_DRAIN_MS, and the CELLD_OTEL family. Upgrading from v0.1.0: - A v0.1.0 command line with a non-loopback --listen refuses to start until an explicit --internal-listen is added. - The upgrade must not be a rolling update: stop every v0.1.0 node, then start the v0.2.0 nodes. v0.2.0 advertises the internal listener, which v0.1.0 peers cannot follow, and writes compacted block objects, which a v0.1.0 reader cannot restore. A fleet must not mix the two versions. Co-authored-by: Nathan Whitaker <nathan@deno.com> Co-authored-by: Connor Hindley <conn.hindley@gmail.com> Co-authored-by: Yusuke Tanaka <yusuktan@maguro.dev> Co-authored-by: Heyang Zhou <hello@su3.io> Co-authored-by: Daniel Lee <danielylee@google.com> | 2 个月前 | |
v0.2.0 celld v0.2.0 changes three foundations: how cells share memory, how their state replicates, and how a fleet stays available when its object store fails or slows. Isolates and memory: - Resident cells share isolates and run turn by turn on a shared pool. v0.1.0 held one OS thread and one isolate for each cell. - A resident cell costs ~471 KB against ~3.4 MB in v0.1.0, measured linear to 2,500 resident cells (~1.2 GB) on one node. Memory no longer limits the resident population; admission and RSS shedding set the limit. - A handler that awaits I/O releases its isolate between turns, so co-resident cells cannot stall each other. - celld reclaims empty cell heaps and reuses retired isolate slots, so a long-lived node cannot leak isolates. - jemalloc is the global allocator. Two listeners: - celld now separates the data plane from the control plane. The public listener (--listen) serves only your Worker's routes and /__celld/health. A new internal listener (--internal-listen) carries everything else: the operator API (/state, /shutdown) and all node-to-node peer traffic. Keep the internal port on a private network. - A public listener on a non-loopback address requires an explicit internal listener. --advertise names the internal address, and celld diagnose probes peers at that address. Replication and compaction: - celld compacts many small level-0 replication objects into additive level-1 blocks (LTX v0.5.2 block format). Compaction is on by default and never deletes a source object. - A takeover of a write-heavy cell reads tens of objects instead of thousands. In one measured case, a cell with 4,096 durable writes restored from 42 objects and 0.6 MB instead of 4,116 objects and 19 MB, 3.8 times faster. - A restore downloads the objects in its plan concurrently, under one ceiling for the whole node. - A takeover pins the exact point in the replicated history that it restored from. celld never restores data that a fenced former owner uploads after that point, so a cell's history cannot fork and a failed write cannot reappear after a failover. - Compaction runs off the request path with a bounded duty cycle. A node that restarts with a large uncompacted backlog drains it without blocking durable writes. - celld and Litestream v0.5.16 can read both block and frame files. Litestream v0.5.11 can read only frame files. Availability under storage faults: - The time that remains on the last renewed lease bounds each lease renewal attempt, so one hung conditional write can no longer use the whole authority window. In a test that silently dropped all established storage connections for 20 seconds, a v0.1.0-class node fenced; a v0.2.0 node kept serving. - The core event loop owns the lease timer on a dedicated thread. Restores, compaction, and diagnostics cannot delay it. - celld logs each lease attempt at start and at completion, so a storage hang is distinguishable from a timer failure. Shutdown and restart: - SIGTERM starts a graceful drain. The drain hands each cell to a peer directly, so takeover does not wait for the lease TTL. - POST /shutdown?handoff=preserve on the internal listener prepares a same-node restart. The replacement process resumes its local cell databases and performs no owner or replica reads. - The drain waits for its ownership release writes and bounds each connection, so one idle connection cannot use the full deadline. - The process exits without unwinding. This fixes a crash when a warm node stops. Storage backends: - A gs:// bucket selects Cloud Storage's generation-based compare-and-swap and authenticates with Application Default Credentials. - A bucket can take a key prefix, so several independent fleets can share one bucket without collisions. Workers surface: - Wasm modules deploy and load as compiled WebAssembly.Module values. A workers-rs example shows the path, and older nodes refuse the new wasm-v1 deployment feature at deploy time. - A new RPC example exercises entrypoints, callbacks, RpcTarget returns, and promise pipelining end to end. Cross-isolate stubs remain limited to single method calls on named entrypoints. - Web Crypto and node:crypto expand: asymmetric import and export (SPKI, PKCS#8, JWK, PEM), generateKey, P-384 and P-521, Ed25519 and X25519, ECDH derivation, AES-CBC and AES-CTR, DigestStream, timingSafeEqual, and one-shot sign and verify. - setWebSocketAutoResponse answers ping-style messages without waking the cell. OpenTelemetry support (off by default): - CELLD_OTEL=1 turns on OpenTelemetry traces and logs with no collector required: celld writes them directly to the bucket as Parquet under a telemetry/ prefix, and DuckDB can query them. - A standard OTLP/HTTP collector is the alternative sink (CELLD_OTEL_SINK=otlp), and the usual OTEL_* variables apply. - W3C trace context propagates end to end: celld adopts an inbound traceparent, and fetch spans, cell dispatch, and console logs join the caller's trace. Overload: - A stateless request that finds every slot held now waits, bounded by CELLD_ADMISSION_WAIT_MS, instead of an immediate refusal. At overload, the node no longer spends its capacity on refusals. - CPU-based shedding is removed. RSS shedding (on by default since v0.1.0) is the only pressure trigger. Configuration: - celld validates every variable at startup, and an invalid value stops startup. Boolean variables accept only 0 or 1. - Removed: CELLD_WORKERS, CELLD_MAX_COHOSTED, CELLD_MAX_CPU_PERCENT, CELLD_RESIDENT_LOW_WATER (ignored since v0.1.0), CELLD_VALIDATE, and the /js route. - Renamed: CELLD_HIBERNATIONS is now CELLD_EVICTIONS. - Changed: CELLD_IDLE_EVICT_S no longer defaults to 300; idle eviction is off unless set. CELLD_UNSAFE_PUBLIC_ADVERTISE takes 1, not on. - Added, among others: CELLD_INTERNAL_ADDR, CELLD_MAX_STATELESS_ISOLATES, CELLD_ADMISSION_WAIT_MS, CELLD_LTX_COMPACTION, CELLD_SHUTDOWN_DRAIN_MS, and the CELLD_OTEL family. Upgrading from v0.1.0: - A v0.1.0 command line with a non-loopback --listen refuses to start until an explicit --internal-listen is added. - The upgrade must not be a rolling update: stop every v0.1.0 node, then start the v0.2.0 nodes. v0.2.0 advertises the internal listener, which v0.1.0 peers cannot follow, and writes compacted block objects, which a v0.1.0 reader cannot restore. A fleet must not mix the two versions. Co-authored-by: Nathan Whitaker <nathan@deno.com> Co-authored-by: Connor Hindley <conn.hindley@gmail.com> Co-authored-by: Yusuke Tanaka <yusuktan@maguro.dev> Co-authored-by: Heyang Zhou <hello@su3.io> Co-authored-by: Daniel Lee <danielylee@google.com> | 2 个月前 | |
v0.2.0 celld v0.2.0 changes three foundations: how cells share memory, how their state replicates, and how a fleet stays available when its object store fails or slows. Isolates and memory: - Resident cells share isolates and run turn by turn on a shared pool. v0.1.0 held one OS thread and one isolate for each cell. - A resident cell costs ~471 KB against ~3.4 MB in v0.1.0, measured linear to 2,500 resident cells (~1.2 GB) on one node. Memory no longer limits the resident population; admission and RSS shedding set the limit. - A handler that awaits I/O releases its isolate between turns, so co-resident cells cannot stall each other. - celld reclaims empty cell heaps and reuses retired isolate slots, so a long-lived node cannot leak isolates. - jemalloc is the global allocator. Two listeners: - celld now separates the data plane from the control plane. The public listener (--listen) serves only your Worker's routes and /__celld/health. A new internal listener (--internal-listen) carries everything else: the operator API (/state, /shutdown) and all node-to-node peer traffic. Keep the internal port on a private network. - A public listener on a non-loopback address requires an explicit internal listener. --advertise names the internal address, and celld diagnose probes peers at that address. Replication and compaction: - celld compacts many small level-0 replication objects into additive level-1 blocks (LTX v0.5.2 block format). Compaction is on by default and never deletes a source object. - A takeover of a write-heavy cell reads tens of objects instead of thousands. In one measured case, a cell with 4,096 durable writes restored from 42 objects and 0.6 MB instead of 4,116 objects and 19 MB, 3.8 times faster. - A restore downloads the objects in its plan concurrently, under one ceiling for the whole node. - A takeover pins the exact point in the replicated history that it restored from. celld never restores data that a fenced former owner uploads after that point, so a cell's history cannot fork and a failed write cannot reappear after a failover. - Compaction runs off the request path with a bounded duty cycle. A node that restarts with a large uncompacted backlog drains it without blocking durable writes. - celld and Litestream v0.5.16 can read both block and frame files. Litestream v0.5.11 can read only frame files. Availability under storage faults: - The time that remains on the last renewed lease bounds each lease renewal attempt, so one hung conditional write can no longer use the whole authority window. In a test that silently dropped all established storage connections for 20 seconds, a v0.1.0-class node fenced; a v0.2.0 node kept serving. - The core event loop owns the lease timer on a dedicated thread. Restores, compaction, and diagnostics cannot delay it. - celld logs each lease attempt at start and at completion, so a storage hang is distinguishable from a timer failure. Shutdown and restart: - SIGTERM starts a graceful drain. The drain hands each cell to a peer directly, so takeover does not wait for the lease TTL. - POST /shutdown?handoff=preserve on the internal listener prepares a same-node restart. The replacement process resumes its local cell databases and performs no owner or replica reads. - The drain waits for its ownership release writes and bounds each connection, so one idle connection cannot use the full deadline. - The process exits without unwinding. This fixes a crash when a warm node stops. Storage backends: - A gs:// bucket selects Cloud Storage's generation-based compare-and-swap and authenticates with Application Default Credentials. - A bucket can take a key prefix, so several independent fleets can share one bucket without collisions. Workers surface: - Wasm modules deploy and load as compiled WebAssembly.Module values. A workers-rs example shows the path, and older nodes refuse the new wasm-v1 deployment feature at deploy time. - A new RPC example exercises entrypoints, callbacks, RpcTarget returns, and promise pipelining end to end. Cross-isolate stubs remain limited to single method calls on named entrypoints. - Web Crypto and node:crypto expand: asymmetric import and export (SPKI, PKCS#8, JWK, PEM), generateKey, P-384 and P-521, Ed25519 and X25519, ECDH derivation, AES-CBC and AES-CTR, DigestStream, timingSafeEqual, and one-shot sign and verify. - setWebSocketAutoResponse answers ping-style messages without waking the cell. OpenTelemetry support (off by default): - CELLD_OTEL=1 turns on OpenTelemetry traces and logs with no collector required: celld writes them directly to the bucket as Parquet under a telemetry/ prefix, and DuckDB can query them. - A standard OTLP/HTTP collector is the alternative sink (CELLD_OTEL_SINK=otlp), and the usual OTEL_* variables apply. - W3C trace context propagates end to end: celld adopts an inbound traceparent, and fetch spans, cell dispatch, and console logs join the caller's trace. Overload: - A stateless request that finds every slot held now waits, bounded by CELLD_ADMISSION_WAIT_MS, instead of an immediate refusal. At overload, the node no longer spends its capacity on refusals. - CPU-based shedding is removed. RSS shedding (on by default since v0.1.0) is the only pressure trigger. Configuration: - celld validates every variable at startup, and an invalid value stops startup. Boolean variables accept only 0 or 1. - Removed: CELLD_WORKERS, CELLD_MAX_COHOSTED, CELLD_MAX_CPU_PERCENT, CELLD_RESIDENT_LOW_WATER (ignored since v0.1.0), CELLD_VALIDATE, and the /js route. - Renamed: CELLD_HIBERNATIONS is now CELLD_EVICTIONS. - Changed: CELLD_IDLE_EVICT_S no longer defaults to 300; idle eviction is off unless set. CELLD_UNSAFE_PUBLIC_ADVERTISE takes 1, not on. - Added, among others: CELLD_INTERNAL_ADDR, CELLD_MAX_STATELESS_ISOLATES, CELLD_ADMISSION_WAIT_MS, CELLD_LTX_COMPACTION, CELLD_SHUTDOWN_DRAIN_MS, and the CELLD_OTEL family. Upgrading from v0.1.0: - A v0.1.0 command line with a non-loopback --listen refuses to start until an explicit --internal-listen is added. - The upgrade must not be a rolling update: stop every v0.1.0 node, then start the v0.2.0 nodes. v0.2.0 advertises the internal listener, which v0.1.0 peers cannot follow, and writes compacted block objects, which a v0.1.0 reader cannot restore. A fleet must not mix the two versions. Co-authored-by: Nathan Whitaker <nathan@deno.com> Co-authored-by: Connor Hindley <conn.hindley@gmail.com> Co-authored-by: Yusuke Tanaka <yusuktan@maguro.dev> Co-authored-by: Heyang Zhou <hello@su3.io> Co-authored-by: Daniel Lee <danielylee@google.com> | 2 个月前 | |
v0.2.0 celld v0.2.0 changes three foundations: how cells share memory, how their state replicates, and how a fleet stays available when its object store fails or slows. Isolates and memory: - Resident cells share isolates and run turn by turn on a shared pool. v0.1.0 held one OS thread and one isolate for each cell. - A resident cell costs ~471 KB against ~3.4 MB in v0.1.0, measured linear to 2,500 resident cells (~1.2 GB) on one node. Memory no longer limits the resident population; admission and RSS shedding set the limit. - A handler that awaits I/O releases its isolate between turns, so co-resident cells cannot stall each other. - celld reclaims empty cell heaps and reuses retired isolate slots, so a long-lived node cannot leak isolates. - jemalloc is the global allocator. Two listeners: - celld now separates the data plane from the control plane. The public listener (--listen) serves only your Worker's routes and /__celld/health. A new internal listener (--internal-listen) carries everything else: the operator API (/state, /shutdown) and all node-to-node peer traffic. Keep the internal port on a private network. - A public listener on a non-loopback address requires an explicit internal listener. --advertise names the internal address, and celld diagnose probes peers at that address. Replication and compaction: - celld compacts many small level-0 replication objects into additive level-1 blocks (LTX v0.5.2 block format). Compaction is on by default and never deletes a source object. - A takeover of a write-heavy cell reads tens of objects instead of thousands. In one measured case, a cell with 4,096 durable writes restored from 42 objects and 0.6 MB instead of 4,116 objects and 19 MB, 3.8 times faster. - A restore downloads the objects in its plan concurrently, under one ceiling for the whole node. - A takeover pins the exact point in the replicated history that it restored from. celld never restores data that a fenced former owner uploads after that point, so a cell's history cannot fork and a failed write cannot reappear after a failover. - Compaction runs off the request path with a bounded duty cycle. A node that restarts with a large uncompacted backlog drains it without blocking durable writes. - celld and Litestream v0.5.16 can read both block and frame files. Litestream v0.5.11 can read only frame files. Availability under storage faults: - The time that remains on the last renewed lease bounds each lease renewal attempt, so one hung conditional write can no longer use the whole authority window. In a test that silently dropped all established storage connections for 20 seconds, a v0.1.0-class node fenced; a v0.2.0 node kept serving. - The core event loop owns the lease timer on a dedicated thread. Restores, compaction, and diagnostics cannot delay it. - celld logs each lease attempt at start and at completion, so a storage hang is distinguishable from a timer failure. Shutdown and restart: - SIGTERM starts a graceful drain. The drain hands each cell to a peer directly, so takeover does not wait for the lease TTL. - POST /shutdown?handoff=preserve on the internal listener prepares a same-node restart. The replacement process resumes its local cell databases and performs no owner or replica reads. - The drain waits for its ownership release writes and bounds each connection, so one idle connection cannot use the full deadline. - The process exits without unwinding. This fixes a crash when a warm node stops. Storage backends: - A gs:// bucket selects Cloud Storage's generation-based compare-and-swap and authenticates with Application Default Credentials. - A bucket can take a key prefix, so several independent fleets can share one bucket without collisions. Workers surface: - Wasm modules deploy and load as compiled WebAssembly.Module values. A workers-rs example shows the path, and older nodes refuse the new wasm-v1 deployment feature at deploy time. - A new RPC example exercises entrypoints, callbacks, RpcTarget returns, and promise pipelining end to end. Cross-isolate stubs remain limited to single method calls on named entrypoints. - Web Crypto and node:crypto expand: asymmetric import and export (SPKI, PKCS#8, JWK, PEM), generateKey, P-384 and P-521, Ed25519 and X25519, ECDH derivation, AES-CBC and AES-CTR, DigestStream, timingSafeEqual, and one-shot sign and verify. - setWebSocketAutoResponse answers ping-style messages without waking the cell. OpenTelemetry support (off by default): - CELLD_OTEL=1 turns on OpenTelemetry traces and logs with no collector required: celld writes them directly to the bucket as Parquet under a telemetry/ prefix, and DuckDB can query them. - A standard OTLP/HTTP collector is the alternative sink (CELLD_OTEL_SINK=otlp), and the usual OTEL_* variables apply. - W3C trace context propagates end to end: celld adopts an inbound traceparent, and fetch spans, cell dispatch, and console logs join the caller's trace. Overload: - A stateless request that finds every slot held now waits, bounded by CELLD_ADMISSION_WAIT_MS, instead of an immediate refusal. At overload, the node no longer spends its capacity on refusals. - CPU-based shedding is removed. RSS shedding (on by default since v0.1.0) is the only pressure trigger. Configuration: - celld validates every variable at startup, and an invalid value stops startup. Boolean variables accept only 0 or 1. - Removed: CELLD_WORKERS, CELLD_MAX_COHOSTED, CELLD_MAX_CPU_PERCENT, CELLD_RESIDENT_LOW_WATER (ignored since v0.1.0), CELLD_VALIDATE, and the /js route. - Renamed: CELLD_HIBERNATIONS is now CELLD_EVICTIONS. - Changed: CELLD_IDLE_EVICT_S no longer defaults to 300; idle eviction is off unless set. CELLD_UNSAFE_PUBLIC_ADVERTISE takes 1, not on. - Added, among others: CELLD_INTERNAL_ADDR, CELLD_MAX_STATELESS_ISOLATES, CELLD_ADMISSION_WAIT_MS, CELLD_LTX_COMPACTION, CELLD_SHUTDOWN_DRAIN_MS, and the CELLD_OTEL family. Upgrading from v0.1.0: - A v0.1.0 command line with a non-loopback --listen refuses to start until an explicit --internal-listen is added. - The upgrade must not be a rolling update: stop every v0.1.0 node, then start the v0.2.0 nodes. v0.2.0 advertises the internal listener, which v0.1.0 peers cannot follow, and writes compacted block objects, which a v0.1.0 reader cannot restore. A fleet must not mix the two versions. Co-authored-by: Nathan Whitaker <nathan@deno.com> Co-authored-by: Connor Hindley <conn.hindley@gmail.com> Co-authored-by: Yusuke Tanaka <yusuktan@maguro.dev> Co-authored-by: Heyang Zhou <hello@su3.io> Co-authored-by: Daniel Lee <danielylee@google.com> | 2 个月前 | |
v0.2.0 celld v0.2.0 changes three foundations: how cells share memory, how their state replicates, and how a fleet stays available when its object store fails or slows. Isolates and memory: - Resident cells share isolates and run turn by turn on a shared pool. v0.1.0 held one OS thread and one isolate for each cell. - A resident cell costs ~471 KB against ~3.4 MB in v0.1.0, measured linear to 2,500 resident cells (~1.2 GB) on one node. Memory no longer limits the resident population; admission and RSS shedding set the limit. - A handler that awaits I/O releases its isolate between turns, so co-resident cells cannot stall each other. - celld reclaims empty cell heaps and reuses retired isolate slots, so a long-lived node cannot leak isolates. - jemalloc is the global allocator. Two listeners: - celld now separates the data plane from the control plane. The public listener (--listen) serves only your Worker's routes and /__celld/health. A new internal listener (--internal-listen) carries everything else: the operator API (/state, /shutdown) and all node-to-node peer traffic. Keep the internal port on a private network. - A public listener on a non-loopback address requires an explicit internal listener. --advertise names the internal address, and celld diagnose probes peers at that address. Replication and compaction: - celld compacts many small level-0 replication objects into additive level-1 blocks (LTX v0.5.2 block format). Compaction is on by default and never deletes a source object. - A takeover of a write-heavy cell reads tens of objects instead of thousands. In one measured case, a cell with 4,096 durable writes restored from 42 objects and 0.6 MB instead of 4,116 objects and 19 MB, 3.8 times faster. - A restore downloads the objects in its plan concurrently, under one ceiling for the whole node. - A takeover pins the exact point in the replicated history that it restored from. celld never restores data that a fenced former owner uploads after that point, so a cell's history cannot fork and a failed write cannot reappear after a failover. - Compaction runs off the request path with a bounded duty cycle. A node that restarts with a large uncompacted backlog drains it without blocking durable writes. - celld and Litestream v0.5.16 can read both block and frame files. Litestream v0.5.11 can read only frame files. Availability under storage faults: - The time that remains on the last renewed lease bounds each lease renewal attempt, so one hung conditional write can no longer use the whole authority window. In a test that silently dropped all established storage connections for 20 seconds, a v0.1.0-class node fenced; a v0.2.0 node kept serving. - The core event loop owns the lease timer on a dedicated thread. Restores, compaction, and diagnostics cannot delay it. - celld logs each lease attempt at start and at completion, so a storage hang is distinguishable from a timer failure. Shutdown and restart: - SIGTERM starts a graceful drain. The drain hands each cell to a peer directly, so takeover does not wait for the lease TTL. - POST /shutdown?handoff=preserve on the internal listener prepares a same-node restart. The replacement process resumes its local cell databases and performs no owner or replica reads. - The drain waits for its ownership release writes and bounds each connection, so one idle connection cannot use the full deadline. - The process exits without unwinding. This fixes a crash when a warm node stops. Storage backends: - A gs:// bucket selects Cloud Storage's generation-based compare-and-swap and authenticates with Application Default Credentials. - A bucket can take a key prefix, so several independent fleets can share one bucket without collisions. Workers surface: - Wasm modules deploy and load as compiled WebAssembly.Module values. A workers-rs example shows the path, and older nodes refuse the new wasm-v1 deployment feature at deploy time. - A new RPC example exercises entrypoints, callbacks, RpcTarget returns, and promise pipelining end to end. Cross-isolate stubs remain limited to single method calls on named entrypoints. - Web Crypto and node:crypto expand: asymmetric import and export (SPKI, PKCS#8, JWK, PEM), generateKey, P-384 and P-521, Ed25519 and X25519, ECDH derivation, AES-CBC and AES-CTR, DigestStream, timingSafeEqual, and one-shot sign and verify. - setWebSocketAutoResponse answers ping-style messages without waking the cell. OpenTelemetry support (off by default): - CELLD_OTEL=1 turns on OpenTelemetry traces and logs with no collector required: celld writes them directly to the bucket as Parquet under a telemetry/ prefix, and DuckDB can query them. - A standard OTLP/HTTP collector is the alternative sink (CELLD_OTEL_SINK=otlp), and the usual OTEL_* variables apply. - W3C trace context propagates end to end: celld adopts an inbound traceparent, and fetch spans, cell dispatch, and console logs join the caller's trace. Overload: - A stateless request that finds every slot held now waits, bounded by CELLD_ADMISSION_WAIT_MS, instead of an immediate refusal. At overload, the node no longer spends its capacity on refusals. - CPU-based shedding is removed. RSS shedding (on by default since v0.1.0) is the only pressure trigger. Configuration: - celld validates every variable at startup, and an invalid value stops startup. Boolean variables accept only 0 or 1. - Removed: CELLD_WORKERS, CELLD_MAX_COHOSTED, CELLD_MAX_CPU_PERCENT, CELLD_RESIDENT_LOW_WATER (ignored since v0.1.0), CELLD_VALIDATE, and the /js route. - Renamed: CELLD_HIBERNATIONS is now CELLD_EVICTIONS. - Changed: CELLD_IDLE_EVICT_S no longer defaults to 300; idle eviction is off unless set. CELLD_UNSAFE_PUBLIC_ADVERTISE takes 1, not on. - Added, among others: CELLD_INTERNAL_ADDR, CELLD_MAX_STATELESS_ISOLATES, CELLD_ADMISSION_WAIT_MS, CELLD_LTX_COMPACTION, CELLD_SHUTDOWN_DRAIN_MS, and the CELLD_OTEL family. Upgrading from v0.1.0: - A v0.1.0 command line with a non-loopback --listen refuses to start until an explicit --internal-listen is added. - The upgrade must not be a rolling update: stop every v0.1.0 node, then start the v0.2.0 nodes. v0.2.0 advertises the internal listener, which v0.1.0 peers cannot follow, and writes compacted block objects, which a v0.1.0 reader cannot restore. A fleet must not mix the two versions. Co-authored-by: Nathan Whitaker <nathan@deno.com> Co-authored-by: Connor Hindley <conn.hindley@gmail.com> Co-authored-by: Yusuke Tanaka <yusuktan@maguro.dev> Co-authored-by: Heyang Zhou <hello@su3.io> Co-authored-by: Daniel Lee <danielylee@google.com> | 2 个月前 | |
v0.2.0 celld v0.2.0 changes three foundations: how cells share memory, how their state replicates, and how a fleet stays available when its object store fails or slows. Isolates and memory: - Resident cells share isolates and run turn by turn on a shared pool. v0.1.0 held one OS thread and one isolate for each cell. - A resident cell costs ~471 KB against ~3.4 MB in v0.1.0, measured linear to 2,500 resident cells (~1.2 GB) on one node. Memory no longer limits the resident population; admission and RSS shedding set the limit. - A handler that awaits I/O releases its isolate between turns, so co-resident cells cannot stall each other. - celld reclaims empty cell heaps and reuses retired isolate slots, so a long-lived node cannot leak isolates. - jemalloc is the global allocator. Two listeners: - celld now separates the data plane from the control plane. The public listener (--listen) serves only your Worker's routes and /__celld/health. A new internal listener (--internal-listen) carries everything else: the operator API (/state, /shutdown) and all node-to-node peer traffic. Keep the internal port on a private network. - A public listener on a non-loopback address requires an explicit internal listener. --advertise names the internal address, and celld diagnose probes peers at that address. Replication and compaction: - celld compacts many small level-0 replication objects into additive level-1 blocks (LTX v0.5.2 block format). Compaction is on by default and never deletes a source object. - A takeover of a write-heavy cell reads tens of objects instead of thousands. In one measured case, a cell with 4,096 durable writes restored from 42 objects and 0.6 MB instead of 4,116 objects and 19 MB, 3.8 times faster. - A restore downloads the objects in its plan concurrently, under one ceiling for the whole node. - A takeover pins the exact point in the replicated history that it restored from. celld never restores data that a fenced former owner uploads after that point, so a cell's history cannot fork and a failed write cannot reappear after a failover. - Compaction runs off the request path with a bounded duty cycle. A node that restarts with a large uncompacted backlog drains it without blocking durable writes. - celld and Litestream v0.5.16 can read both block and frame files. Litestream v0.5.11 can read only frame files. Availability under storage faults: - The time that remains on the last renewed lease bounds each lease renewal attempt, so one hung conditional write can no longer use the whole authority window. In a test that silently dropped all established storage connections for 20 seconds, a v0.1.0-class node fenced; a v0.2.0 node kept serving. - The core event loop owns the lease timer on a dedicated thread. Restores, compaction, and diagnostics cannot delay it. - celld logs each lease attempt at start and at completion, so a storage hang is distinguishable from a timer failure. Shutdown and restart: - SIGTERM starts a graceful drain. The drain hands each cell to a peer directly, so takeover does not wait for the lease TTL. - POST /shutdown?handoff=preserve on the internal listener prepares a same-node restart. The replacement process resumes its local cell databases and performs no owner or replica reads. - The drain waits for its ownership release writes and bounds each connection, so one idle connection cannot use the full deadline. - The process exits without unwinding. This fixes a crash when a warm node stops. Storage backends: - A gs:// bucket selects Cloud Storage's generation-based compare-and-swap and authenticates with Application Default Credentials. - A bucket can take a key prefix, so several independent fleets can share one bucket without collisions. Workers surface: - Wasm modules deploy and load as compiled WebAssembly.Module values. A workers-rs example shows the path, and older nodes refuse the new wasm-v1 deployment feature at deploy time. - A new RPC example exercises entrypoints, callbacks, RpcTarget returns, and promise pipelining end to end. Cross-isolate stubs remain limited to single method calls on named entrypoints. - Web Crypto and node:crypto expand: asymmetric import and export (SPKI, PKCS#8, JWK, PEM), generateKey, P-384 and P-521, Ed25519 and X25519, ECDH derivation, AES-CBC and AES-CTR, DigestStream, timingSafeEqual, and one-shot sign and verify. - setWebSocketAutoResponse answers ping-style messages without waking the cell. OpenTelemetry support (off by default): - CELLD_OTEL=1 turns on OpenTelemetry traces and logs with no collector required: celld writes them directly to the bucket as Parquet under a telemetry/ prefix, and DuckDB can query them. - A standard OTLP/HTTP collector is the alternative sink (CELLD_OTEL_SINK=otlp), and the usual OTEL_* variables apply. - W3C trace context propagates end to end: celld adopts an inbound traceparent, and fetch spans, cell dispatch, and console logs join the caller's trace. Overload: - A stateless request that finds every slot held now waits, bounded by CELLD_ADMISSION_WAIT_MS, instead of an immediate refusal. At overload, the node no longer spends its capacity on refusals. - CPU-based shedding is removed. RSS shedding (on by default since v0.1.0) is the only pressure trigger. Configuration: - celld validates every variable at startup, and an invalid value stops startup. Boolean variables accept only 0 or 1. - Removed: CELLD_WORKERS, CELLD_MAX_COHOSTED, CELLD_MAX_CPU_PERCENT, CELLD_RESIDENT_LOW_WATER (ignored since v0.1.0), CELLD_VALIDATE, and the /js route. - Renamed: CELLD_HIBERNATIONS is now CELLD_EVICTIONS. - Changed: CELLD_IDLE_EVICT_S no longer defaults to 300; idle eviction is off unless set. CELLD_UNSAFE_PUBLIC_ADVERTISE takes 1, not on. - Added, among others: CELLD_INTERNAL_ADDR, CELLD_MAX_STATELESS_ISOLATES, CELLD_ADMISSION_WAIT_MS, CELLD_LTX_COMPACTION, CELLD_SHUTDOWN_DRAIN_MS, and the CELLD_OTEL family. Upgrading from v0.1.0: - A v0.1.0 command line with a non-loopback --listen refuses to start until an explicit --internal-listen is added. - The upgrade must not be a rolling update: stop every v0.1.0 node, then start the v0.2.0 nodes. v0.2.0 advertises the internal listener, which v0.1.0 peers cannot follow, and writes compacted block objects, which a v0.1.0 reader cannot restore. A fleet must not mix the two versions. Co-authored-by: Nathan Whitaker <nathan@deno.com> Co-authored-by: Connor Hindley <conn.hindley@gmail.com> Co-authored-by: Yusuke Tanaka <yusuktan@maguro.dev> Co-authored-by: Heyang Zhou <hello@su3.io> Co-authored-by: Daniel Lee <danielylee@google.com> | 2 个月前 |
| 文件 | 最后提交记录 | 最后更新时间 |
|---|---|---|
| 2 个月前 | ||
| 2 个月前 | ||
| 2 个月前 | ||
| 2 个月前 | ||
| 2 个月前 | ||
| 2 个月前 | ||
| 2 个月前 | ||
| 2 个月前 | ||
| 2 个月前 | ||
| 2 个月前 | ||
| 2 个月前 | ||
| 2 个月前 | ||
| 2 个月前 | ||
| 2 个月前 | ||
| 2 个月前 |