Skip to content
The Data EngineeringThe Data EngineeringBeta
About
Main content

Multi-tenant isolation and quotas

What can a quota govern, and why is the noisy neighbor everything else?

A quota can only govern a resource the system can both name and attribute to a tenant.

  • Attributable: CPU-seconds, bytes scanned, slots.
  • Not attributable: last-level cache, memory bandwidth, network-card , the shared metadata service, the buffer pool. These are consumed but not requested, and the accounting is not merely unimplemented but genuinely hard: a tenant's cache evictions harm others without any measurable act of its own.

That residue is the noisy-neighbor problem, in its entirety: it is exactly the set of resources outside the quota namespace. Hardware partitioning shrinks the set. Nothing eliminates it.

Quotas also inherit reclaim granularity from capacity scheduling. A tenant over quota is corrected only when something it holds is released, so the enforcement lag equals the task duration unless you preempt. A "hard" quota over long-running tasks is soft in practice.

Everything else is the , by definition.