Each database has one writer; reads run in parallel. A write is acknowledged once a quorum has stored and applied it. When queues are full, Flower returns 503. Treat that as backpressure and slow down.
Execution budgets
| Budget | Default |
|---|---|
| Evaluation deadline | 5 seconds |
| Source bundle | 2 MiB |
| Result / exchange size | 16 MiB |
| QuickJS/Wasm memory (all live callbacks) | 128 MiB |
| Rust bookkeeping memory | 128 MiB |
All are set at node startup. They bound Flower's own accounting, not total process memory.
Admission and overload
- Heavy queries, calls and watch refreshes wait for shared node capacity. Partitions take turns fairly. Operator work has its own reserve.
- When capacity or queued bytes run out, requests fail with 503
ADMISSION_OVERLOADED. FLOWER_PREPARATION_WORKERSsets the shared worker pool.FLOWER_QUERY_WORKERSsets authorization and cache-lookup workers, and is the default for the preparation pool.GET /admin/resources(admin token) shows active and queued work, bytes, oldest wait and rejection counts.- Cached query results are served without taking a worker slot. Apps with an authorization hook or managed keys skip this shortcut.
- Wasm instances are reused but every callback starts from a clean state.
FLOWER_WASM_RECYCLE=0turns reuse off;FLOWER_WASM_RECYCLE_BYTES(default 96 MiB) caps idle memory. Each instance reserves 4 GiB of virtual address space, not RAM.
Durability and history
- Data is stored in redb. After a crash, nodes rebuild from the Raft log without rerunning your code.
- Backups must keep node identity and data, for every group involved.
- Retry results, finished jobs, timer failures and transaction records grow until you clean them up (see retry retention). Don't delete this metadata by hand; that breaks guarantees.
Security
- Only deployed aliases are public. Use
define({authorize})to identify callers; Flower has no identity provider. FLOWER_ADMIN_TOKENprotects operator routes.FLOWER_PEER_TOKENprotects internal routes (defaults to the admin token).- Traffic is unencrypted h2c by default. Set
FLOWER_TLS_CERT_FILE,FLOWER_TLS_KEY_FILEandFLOWER_TLS_CA_FILEtogether for TLS. See the TLS operating contract. - Any trusted peer has full cluster authority.
Upgrades and shutdown
- New members join as learners and vote once caught up.
- Compatible builds can be upgraded one node at a time. Incompatible builds need a coordinated upgrade. Downgrading a data directory is not supported.
- Restart with the same node ID and directory. Don't initialize again.
- After a restart, reads may wait until the node confirms it has caught up with a quorum.
- SIGINT/SIGTERM stop new requests and drain for a bounded time. Interrupted calls may still have committed; retry with the same request ID.
- Benchmarks run all replicas on one host. They are not a capacity promise for your application.
More detail: all operator settings, operating walkthrough, membership and rolling upgrades, HTTP/storage protocol, latest benchmark report.