Why is a simple distributed lock with a TTL / lease duration insufficient without fencing tokens?

In a real-world asynchronous distributed system, processes experience unpredictable delays: Stop-the-World Garbage Collection (GC) pauses, CPU starvation, page faults, or hypervisor context switches. Suppose Client 1 acquires a lock with a 10-second lease, enters a 15-second GC pause, and wakes up believing it still owns the lock. Meanwhile, the lease expired and Client 2 acquired the lock. Both clients now believe they hold the lock and write concurrently to shared storage, corrupting data. As proven by Martin Kleppmann, a lock without a monotonically increasing fencing token cannot protect shared resources against out-of-order writes caused by process pauses.

How does a Fencing Token guarantee safety against delayed, zombie lock holders?

A fencing token is a monotonically increasing integer generated by the lock manager every time a lock is granted (e.g., token 33, token 34, token 35). When the lock holder writes to the shared storage service, it attaches its fencing token to the write request. The storage service tracks the highest token it has ever accepted and rejects any write presenting a lower or equal token. If Client 1 experiences a GC pause and awakes after Client 2 (with token 34) has already written, Client 1's delayed write (with token 33) is immediately rejected with an error, preserving data integrity.

How does ZooKeeper implement distributed locking using sequential ephemeral znodes to prevent the Thundering Herd?

ZooKeeper avoids the "thundering herd" problem (where all waiting clients wake up simultaneously and hammer the server when a lock is released) using sequential ephemeral nodes. To acquire a lock, a client creates an ephemeral sequential znode like /lock/lock-0000000001. It then lists children of /lock. If its znode has the lowest sequence number, it holds the lock. If not, it sets a watch ONLY on the immediately preceding znode (e.g. node 4 watches node 3, node 3 watches node 2). When node 2 releases its lock or crashes, only node 3 receives a notification and acquires the lock, ensuring O(1) message overhead per lock handover.

What is the debate between Salvatore Sanfilippo (Antirez) and Martin Kleppmann regarding Redis Redlock?

Redlock coordinates locking across N independent Redis nodes without consensus: a client acquires the lock if it receives a majority of grants within a timeout. Martin Kleppmann published a famous analysis demonstrating that Redlock relies on dangerous timing assumptions: if system clocks jump (due to NTP desynchronization or VM clock drift), leases expire prematurely. Furthermore, Redlock does not provide fencing tokens. Salvatore Sanfilippo defended Redlock for operational use cases (such as preventing duplicate emails or heavy batch tasks) where occasional dual-execution is benign. For correctness-critical storage updates, consensus-backed systems (ZooKeeper, etcd, Chubby) with fencing tokens are mandatory.

Distributed Locks & Fencing Tokens Studio: Redlock, ZooKeeper Ephemeral Nodes & Safety Proofs

Verified Specification | Standardized Formulas | Instant Precision

Secure & Private (Zero Data Retention) Free Access • No Sign-Up

Distributed Locks & Fencing Tokens Studio

Architect fault-tolerant distributed mutual exclusion: simulate process pauses, test monotonic fencing token storage guards, and inspect ZooKeeper lock queues.

Fencing Token Active Linearizable Mutex

Token #34

Current Monotonic Fencing Token

Token #34

Storage Guard Min Accepted Token

3 Clients

Sequential Ephemeral Queue Depth

Protected

Split-Brain / Dual-Write Status

1. Distributed Lock Architecture & Failure Simulator

Lock Coordination Protocol

Fencing Token Enforcement at Storage

Client 1 Process Pause (GC / CPU Stall)

2. Process Execution Race & Storage Write Attempt

Simulate Client 1 pausing, Client 2 taking the lock, and Client 1 awaking to issue a delayed write.

Click "Trigger Execution Race" to evaluate storage guard outcome.

3. Active Ephemeral Lock Queue (/locks/resource_01)

4. Production Distributed Lock & Fencing Code

// Generated lock and fencing code

Distributed Locks & Fencing Tokens Studio

1. Distributed Lock Architecture & Failure Simulator

2. Process Execution Race & Storage Write Attempt

3. Active Ephemeral Lock Queue (/locks/resource_01)

4. Production Distributed Lock & Fencing Code

🔍 Companion Workbenches & Verification Tools

LSM-Tree Advanced: Leveled vs Tiered Compaction, Bloom Filters & Write Stall Studio

Linux CFS Bandwidth & CPU Quota Studio: cgroups v2, cpu.max, vruntime & Throttling

Linux PSI (Pressure Stall Information), cgroups v2 & systemd-oomd Architecture Studio

JWT Token Decoder & Header Inspector

Why Smart Users Are Switching to This Free Toolkit

The Browser Feature Most People Never Use

Stop Paying for Software You Can Get Free

File Conversion Tricks That Save Hours Every Week

This Free Tool Replaced 5 Paid Apps for Our Team

What Your Browser Can Do Without Any Extensions