Question 1116

Paused at the Worst Time

Worker A acquires a 20 second lease and begins building a file. A stop-the-world GC pause freezes it for 25 seconds. The lease expires, worker B acquires the lock and writes the file. A then resumes and issues its own write to the same object store. Which mechanism actually prevents the corrupted result?

A

All workers and lock servers run NTP so their clocks stay within a few milliseconds of each other

B

The store rejects any write whose fencing token is lower than the highest token it has already accepted

C

A checks the remaining lease time immediately before issuing the write and aborts if it is close to zero

D

The lease TTL is raised to 5 minutes so a pause of this length can no longer outlast it