Conversation
Postgres in a dstack CVM that treats the disk as a cache: wal-g ships every WAL segment to an S3-compatible bucket (Cloudflare R2), encrypted under a key the app derives from the KMS — nothing outside the enclave ever holds it. Two drills. Disk loss: wipe the volume, redeploy the same app as a standby, promote. Node loss: `phala cvms replicate` a standby onto another node (same app id -> same derived key, no connection to the primary), SIGKILL the primary mid-write, promote, count acked writes lost. Real numbers: 429/771 lost at archive_timeout=60s, 16/739 at 15s (the bound is the guarantee, the sample depends on where the kill lands). verify.sh checks the three claims live. Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]> Claude-Session: https://claude.ai/code/session_01BVSS9AUWZVgcHbmLr4KvBt
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Postgres in a dstack CVM that treats the disk as a cache. wal-g ships every WAL segment to an S3-compatible bucket (Cloudflare R2), encrypted under a key the app derives from the KMS — nothing outside the enclave ever holds it. A node that loses its disk, or a whole node, rebuilds from the archive.
Two drills
SELECT pg_promote(). The canary survives; no key was carried across, the app re-derived it.phala cvms replicatea standby onto a second node (same app id → same derived key,primary_conninfoempty, never connects to the primary), SIGKILL the primary mid-write, promote the standby, count acknowledged writes lost.Measured
Two real CVMs on two nodes, writer through the gateway,
docker rm -fon the primary (SIGKILL, no archive flush):archive_timeoutRPO is bounded by
archive_timeout(that's the guarantee); the sample depends on where the kill lands in the archive cycle.verify.shchecks the three claims against a live CVM: keys derived not stored, archive current, bucket holds ciphertext.What's here
docker-compose.yml— inline entrypoint: derives the superuser password and WAL key fromGetKey,PG_ROLEprimary/standby, archive on both roles so a promoted standby re-arms,wal_retrieve_retry_interval=30sso a caught-up standby stops polling the bucket.README.md— the two drills, the numbers with denominators, how it works, and the honest open problems (RPO 0 needs streaming; archive rollback).verify.sh— live verification.Draft: opening for a review pass before marking ready.
🤖 Generated with Claude Code
https://claude.ai/code/session_01BVSS9AUWZVgcHbmLr4KvBt