Failover
How Silos is designed to handle a primary failure — and an honest statement of current maturity.
Replication exists partly for resilience: if the primary becomes unavailable, the system should recover with minimal disruption. This page describes the designed-for failover behavior and is candid about what is and isn't guaranteed today.
Automatic failover is designed for, not guaranteed. The architecture anticipates promotion of a replica and re-routing on primary failure, but Silos does not currently provide an automatic-failover or zero-downtime guarantee. Do not rely on automatic failover for a production SLA yet. This is a roadmap area — see the Replication overview.
The intended design
The model that replication is built toward:
- The primary owns writes; replicas follow the WAL and hold recent state.
- On a primary failure, a sufficiently caught-up replica would be promoted to primary, and routing would shift writes to the new primary.
- Durable state lives in object storage (snapshots + WAL), so even without a hot replica, a database can be re-materialized from storage — this is the same hydration path used for cold starts and replica materialization.
Durability vs. availability
It helps to separate two concerns:
- Durability — is my data safe? Silos persists committed state as snapshots and WAL in object storage, encrypted at rest. Data that's been written and persisted isn't lost when a compute instance dies; a runtime can be rebuilt from storage.
- Availability — can I serve traffic right now? This is where automatic failover matters, and it's the part that is not yet guaranteed. A primary outage may cause write unavailability until the database is recovered or re-materialized.
What to do today
- For workloads that can tolerate brief write unavailability, the storage-backed recovery path means data is safe and the database can come back.
- For workloads that need continuous write availability with automatic promotion, treat that as not yet available and design accordingly — or talk to us about your requirements via silos.sh/contact.