Reference · 16

Operational limits.

The limits and failure modes your code should plan for.

Each database has one writer; reads run in parallel. A write is acknowledged once a quorum has stored and applied it. When queues are full, Flower returns 503. Treat that as backpressure and slow down.

Execution budgets

Budget	Default
Evaluation deadline	10 seconds
Source bundle	2 MiB
Result / exchange size	16 MiB
QuickJS/Wasm memory (all live callbacks)	128 MiB
Rust bookkeeping memory	128 MiB

All are set at node startup. They bound Flower's own accounting, not total process memory.

Admission and overload

Heavy queries, calls and watch refreshes wait for shared node capacity. Partitions take turns fairly. Operator work has its own reserve.
When capacity or queued bytes run out, requests fail with 503 ADMISSION_OVERLOADED.
FLOWER_PREPARATION_WORKERS sets the shared worker pool. FLOWER_QUERY_WORKERS sets authorization and cache-lookup workers, and is the default for the preparation pool.
GET /admin/resources (admin token) shows active and queued work, bytes, oldest wait and rejection counts.
Cached query results are served without taking a worker slot. Apps with an access check or managed keys skip this shortcut.
Wasm instances are reused but every callback starts from a clean state. FLOWER_WASM_RECYCLE=0 turns reuse off; FLOWER_WASM_RECYCLE_BYTES (default 96 MiB) caps idle memory. Each instance reserves 4 GiB of virtual address space, not RAM.

Durability and history

Data is stored in redb. After a crash, nodes rebuild from the Raft log without rerunning your code.
Backups must keep node identity and data, for every group involved.
Retry results, finished jobs, timer failures and transaction records grow until you clean them up (see retry retention). Don't delete this metadata by hand; that breaks guarantees.

Security

Only deployed aliases are public. Use define({ auth }) and per-method access to identify and admit callers; Flower has no identity provider.
FLOWER_ADMIN_TOKEN protects operator routes. FLOWER_PEER_TOKEN protects internal routes (defaults to the admin token).
Traffic is unencrypted h2c by default. Set FLOWER_TLS_CERT_FILE, FLOWER_TLS_KEY_FILE and FLOWER_TLS_CA_FILE together for TLS. See the TLS operating contract.
Any trusted peer has full cluster authority.

Upgrades and shutdown

New members join as learners and vote once caught up.
Compatible builds can be upgraded one node at a time. Incompatible builds need a coordinated upgrade. Downgrading a data directory is not supported.
Restart with the same node ID and directory. Don't initialize again.
After a restart, reads may wait until the node confirms it has caught up with a quorum.
SIGINT/SIGTERM stop new requests and drain for a bounded time. Interrupted calls may still have committed; retry with the same request ID.
Benchmarks run all replicas on one host. They are not a capacity promise for your application.

More detail: all operator settings, operating walkthrough, membership and rolling upgrades, HTTP/storage protocol, latest benchmark report.