fix: enforce 1:1 worker-to-session with full DuckDB state reset#317
Open
fix: enforce 1:1 worker-to-session with full DuckDB state reset#317
Conversation
Workers now get a completely fresh DuckDB instance between sessions. Previously, only temp tables/views were cleaned up, which leaked SET variables, prepared statements, and other session state to the next connection on the same worker. Changes: - DestroySession closes the old *sql.DB and eagerly creates a fresh one via CreateDBConnection (~90ms), guaranteeing clean state - Remove least-loaded worker routing from AcquireWorker; when at capacity, wait with backoff until a worker becomes idle - Move ReleaseWorker after gRPC DestroySession so the worker is only available once its new DB is ready - Remove cleanupSessionState (no longer needed) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Replace the ~90ms close-and-reopen DuckDB approach with an exhaustive in-place cleanup that takes ~15-20ms. Uses allowlists of warmup-created objects (macros, views, tables) to distinguish system state from user state. On session destroy: 1. RESET all DuckDB settings 2. Drop temp objects (tables, views) 3. Drop user objects not in allowlists (tables, views, macros, sequences, types) 4. Drop user schemas 5. Detach user databases 6. Drop user secrets 7. Re-apply warmup settings (threads, memory_limit, paths, DuckLake) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Merge origin/main into fix/worker-session-isolation. Resolved conflicts: - k8s_pool.go: removed re-introduced least-loaded routing from PR #315, kept 1:1 idle-or-spawn-or-wait logic - session_mgr.go: took main's improved comments for destroy/release ordering - service.go: removed cleanupSessionState (superseded by resetSessionState) Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
AcquireWorker. When at capacity, workers wait with backoff until one becomes idle (1:1 model).ReleaseWorkermoved after gRPCDestroySessionso the worker is only available once its new DB is ready.Test plan
controlplane,duckdbservice)default_null_order) no longer leaks between sessions in control-plane mode🤖 Generated with Claude Code