The cell, our unit of infrastructure: built by one command in 1.7 minutes

A factory that keeps adding products needs a unit of infrastructure that keeps its shape as it grows. Ours is the cell.

What a cell is

By design, a cell is a self-contained unit, today one server, with everything a product needs to serve its users: an edge holding the TLS certificates and names of the cell's products, a nightly backup and monitoring, all behind a firewall of its own. Each product environment is placed in exactly one cell, and its name points at that cell.

At run time, cells share nothing: no network, no edge, no database. Outside them stay the parts that serve no requests, such as CI and the image registries.

On 22 October the cell replaced our earlier plan, one central edge for every name of every product. With products on several servers, all would fail with the server holding that edge, and reaching the rest would need a private network and service discovery kept by hand. With cells, a failure stays in its cell, and the factory grows by adding cells, not by enlarging a server.

By design, moving a product is three steps: the same image on the new cell, its data, and its name pointed at the new cell. What a product brings, images built in CI, configuration from its environment and a health check the deploy waits for, is what an orchestrator such as Kubernetes also asks for, so that choice stays open.

The first cell built by script

A unit of infrastructure is worth what the next one costs. bin/cell.sh build turns a fresh Ubuntu server into a cell, each part by its own repository's script: host settings, firewall, edge, monitoring and backup.

On 23 October it ran on a throwaway server in another data centre: half a minute for the server, 1.7 minutes for the cell. Then we deployed a live product's production release on it unchanged and restored its two databases from that night's dumps. The whole run took 3.8 minutes and all 13 checks passed, from row counts against the dumps to the product's site and API answering through the new edge. Its name was not pointed at the copy, on purpose, so the copy received no customer requests; then the server was deleted.

The next cell starts from the same command, and the first one's time is on record.