By Rongtong Jin
The Alibaba Cloud Messaging team's paper, _Replication-Free Failover: Protocol-Fenced Takeover for Stateful Services_, has been admitted to the FSE 2026 Industry Papers Track.
A CCF-A premier venue in software engineering, ACM FSE convened in Montreal, July 5–9, 2026. Its Industry Papers Track celebrates research that endures the rigors of production deployment.
The work is distilled from years of building and operating large-scale cloud messaging. Across thousands of tenant-isolated RocketMQ stateful clusters, a persistent question surfaced: can one reconcile low cost, steadfast performance, and expeditious recovery? Replication-Free Failover is the team's answer.
Cloud stateful services covet three objectives that are inherently at odds: inexpensive, steadfast, and swiftly recoverable. The paper's innovations assail precisely this tension.
Begin with what remains invariant. The scheme retains a single replica, a single-node file system, and cloud block storage endowed with storage-side redundancy. It introduces no supplementary business-data replica at the RocketMQ layer and incurs no additional write amplification. The CommitLog and WAL remain untouched. The dividend: the original cost and steady-state performance endure, and compatibility with the Apache RocketMQ community edition remains intact.
Ownership transfer is effected at the storage protocol layer rather than within the application. Multi-Attach exposes the disk to candidate nodes in advance, while NVMe Persistent Reservation (NVMe PR) fences write access. Holder validation, atomic preemption, critical-phase marking, and backoff then consummate the loop, ensuring the write permission cannot be re-preempted mid-recovery.
Once the shared disk becomes visible to a new node, recovery collapses into a state machine. Confirm write permission, purge stale caches, mount the file system, replay the journal, apply crash recovery, and pass a readiness check before traffic resumes—one coherent loop for restoring persisted state and service.
Liveness alone is an inadequate proxy for health. Rather than asking "is the node alive?", the scheme asks "is the primary still persisting?" by reading lease version progress on the shared disk. This distinction apprehends I/O hangs—node up, persistence stalled—and attenuates dependence on a centralized control plane. During network partitions, storage-layer write isolation preserves single-writer safety post-takeover.
High-privilege operations—NVMe PR, cache handling, mounts—are sequestered in a node-side Agent, so business containers never hold system-level rights. Failure detection, permission switching, application recovery, and traffic restoration concatenate into one observable, auditable, repeatedly drillable end-to-end flow.
Many HA routes render nodes stateless: refactor the storage engine, introduce a shared WAL, bolt on object storage. This one proceeds in the opposite direction. It preserves RocketMQ's single-node file system and ordinary read/write semantics, redesigning solely the failover path. Because the HA mechanism does not supplant the normal storage engine, the mature CommitLog, file-system cache, and crash recovery all carry over—and future storage features necessitate no bespoke HA refactor.
The upshot: diminished intrusion into Broker core code, cheaper community upgrades, lighter long-term maintenance. A natural fit for single-primary stateful services already resident in production.
Apache RocketMQ serves as the representative workload. Where a conventional Kubernetes single-replica cloud-disk configuration requires minutes to recover, Replication-Free Failover completes in seconds—while sustaining throughput and latency proximate to a native single-replica deployment.
Production figures corroborate the design: tens of thousands of disaster-recovery drills completed, and the system live in production. Node crashes, I/O hangs, network partitions—the team's authentic incidents are distilled into an HA design for single-primary, single-writer stateful services, furnishing cloud infrastructure a fresh dial among cost, performance, and recovery speed.
As AI Infra leans more heavily on reliable messaging and stateful services, the capability generalizes. Product details and configuration reside in the Alibaba Cloud docs under ApsaraMQ for RocketMQ instance disaster recovery.
The team's trajectory remains anchored to Apache RocketMQ—cloud-native, high-availability, elastic, intelligent ops—transmuting large-scale production experience into reusable capability for enterprise messaging.
• Title: Replication-Free Failover: Protocol-Fenced Takeover for Stateful Services
• Authors: Rongtong Jin, Yinyou Gu, Juntao Ji, Yubao Fu, Tao Liu, Fuzhi Lai, Gaoyang Cai, Qingshan Lin (all Alibaba Cloud)
• Abstract: For cloud single-primary stateful services, the paper proposes a failover mechanism requiring no supplementary business-data replication. It keeps the single-replica single-node file system's normal data path invariant and shortens the recovery chain via storage-protocol-level write isolation. Experiments and production practice demonstrate second-level recovery while sustaining near-single-replica steady-state performance.
Links: FSE 2026 official paper page· ACM Digital Library full paper· ApsaraMQ for RocketMQ instance disaster recovery docs
Zero-Code Transformation: Making the AI Agent Sandbox No Longer a Black Box
773 posts | 60 followers
FollowAlibaba Cloud Native Community - September 16, 2026
Alibaba Cloud Native - July 18, 2024
Alibaba Cloud Native - October 12, 2024
Alibaba Clouder - August 10, 2020
Alibaba Cloud Native Community - October 26, 2023
Alibaba Clouder - December 3, 2020
773 posts | 60 followers
Follow
Application High Availability Service
Application High Available Service is a SaaS-based service that helps you improve the availability of your applications.
Learn More
ApsaraMQ for RocketMQ
ApsaraMQ for RocketMQ is a distributed message queue service that supports reliable message-based asynchronous communication among microservices, distributed systems, and serverless applications.
Learn More
Cloud Parallel File Storage
The fully-managed scalable parallel file system can meet your requirements on high-performance computing.
Learn MoreMore Posts by Alibaba Cloud Native Community
