At 4:20 AM, the VM’s kernel panicked — not from load, but because its ext4 journal hit a 32-bit overflow. The Netflix CDN edge nodes saw the recommendation service fail and started aggressive retries. Within 7 minutes, the retry storm took down the personalization gateway .
It was December 23rd, 2:13 AM. Alex, a senior SRE at Netflix, got a page: CPU steal time > 40% on a single VM in the recommendations-canary cluster. Nothing critical — canary cluster, low traffic. Still, weird. netflix vm config
Then came the really weird part. Because the VM never recycled, its local SSD (ephemeral) had accumulated — normally deleted every week. The ML training pipeline saw this "ancient" VM as a stable node and started preferring it for critical A/B tests. By December 23rd, 3% of all北美 traffic was being routed through this single zombie VM. At 4:20 AM, the VM’s kernel panicked —
He traced the config history. Turned out, a junior engineer had, as a joke 14 months earlier, set a max_ttl_days=0 in a feature flag config — meaning "no timeout." But the flag parser had a bug: 0 got stored as nil , and nil in their system defaulted to . The VM was literally older than the region’s deployment pipeline version . It was December 23rd, 2:13 AM
$ dmidecode -s system-version Netflix Chaperone VM v0xFF Wait — v0xFF ? That wasn’t a real version. Chaperone was their internal VM lifecycle manager. v0xFF was the .
$ cat /proc/cpuinfo | grep "model name" model name : Intel(R) Xeon(R) Platinum 8375C CPU @ 2.90GHz Fine. But then:
Alex SSH’d in. The VM was a standard c5.2xlarge — or so he thought. But one command made him freeze: