Built-in Litestream replication and automatic restore is a new feature I added in OpenRun (a self-hosted deployment platform for web apps). Apps can use SQLite with zero code changes while OpenRun handles backup/recovery. This works on a single node with Docker/Podman and also on Kubernetes.
Do you have any mechanisms in place to prevent two separate instances of OpenRun that share the same configuration from corrupting their shared S3 Litestream store?
That comment was about what happens during an app deployment, to avoid multiple pods on Kubernetes from writing to the same volume. Multiple apps on one OpenRun have no issues, the replication will be identify them as different.
If by mistake you actually have two separate instances of OpenRun pointing to the same S3 volume and path_prefix (with single-node Docker or with Kubernetes), the generated S3 paths have an binding ID which should be unique across instances. I will check whether there is anything more which can be done to prevent any issues with such an incorrect config.
I use the same stack to run my apps! sqlite as Database backen on ephemeral pods. On initialisation, the pod restores the current litestream backup from object storage. No persistent volumes needed. No issues so far.
Without persistent volumes, every deployment of the app may require the SQLite data to be restored from S3, which can take time if database size is large. With PVC, regular app deployments use existing database, only a disaster recovery scenario restores from S3.
Yes, it feels magical to just recreate your namespace or even create a new K8s cluster and see all your apps (from OpenRun metadata) and app data restored automatically.
The ephemeral-pod-plus-restore-on-init pattern works right up until it doesn't, and the failure is quiet, so "no issues so far" is unfortunately consistent with both a correct setup and one that is going to bite.
Litestream assumes a single writer. It replicates one SQLite file's WAL to object storage; it is not multi-master. If you ever end up with two pods writing, you get two databases diverging and replicating over the top of each other, and nothing errors. You find out when you notice writes going missing.
The two ways people get there without meaning to:
- replicas gets bumped above 1, sometimes by an HPA nobody remembered was on.
- RollingUpdate. It briefly runs old and new pods together, which is enough. Recreate avoids it at the cost of a restart gap.
The other thing worth knowing is that replication is asynchronous with a default sync interval of one second, so a hard pod kill can lose whatever was written since the last sync. Fine for a lot of workloads. Not fine if the thing has quietly become a durable transaction log for something that matters.
LiteFS was the answer for genuinely multi-node, though I would check its current maintenance status before building on it.
On Kubernetes, for apps using SQLite, maxReplicas is set to 1 and OpenRun uses the Recreate update strategy. This ensures at most one pod is active (requests are queued until the new pod is healthy). There should never be more than one pod accessing the SQLite database.
UPDATE: Looks like you answered that here already: https://news.ycombinator.com/item?id=49502025
If by mistake you actually have two separate instances of OpenRun pointing to the same S3 volume and path_prefix (with single-node Docker or with Kubernetes), the generated S3 paths have an binding ID which should be unique across instances. I will check whether there is anything more which can be done to prevent any issues with such an incorrect config.
Yes, it feels magical to just recreate your namespace or even create a new K8s cluster and see all your apps (from OpenRun metadata) and app data restored automatically.
The fact that this made it to the main page is either some kind of coordinated effort or bots.
Litestream assumes a single writer. It replicates one SQLite file's WAL to object storage; it is not multi-master. If you ever end up with two pods writing, you get two databases diverging and replicating over the top of each other, and nothing errors. You find out when you notice writes going missing.
The two ways people get there without meaning to:
- replicas gets bumped above 1, sometimes by an HPA nobody remembered was on. - RollingUpdate. It briefly runs old and new pods together, which is enough. Recreate avoids it at the cost of a restart gap.
The other thing worth knowing is that replication is asynchronous with a default sync interval of one second, so a hard pod kill can lose whatever was written since the last sync. Fine for a lot of workloads. Not fine if the thing has quietly become a durable transaction log for something that matters.
LiteFS was the answer for genuinely multi-node, though I would check its current maintenance status before building on it.