What is a failure domain?
A failure domain is a set of hardware that one fault can take down at the same time. A disk, a server, a rack and a whole site are each a failure domain. Redundancy only works when the copies of data, or the replicas of a service, sit in different failure domains, so one fault cannot reach all of them.
Think of carrying eggs to a party. Two cartons in one bag do not help if the bag tears. Each carton needs its own bag, or its own person carrying it.
What are the common levels?
Failure domains nest inside each other. A larger domain holds many smaller ones, and losing it takes all of them down at once.
Disk and server
A dead disk loses only its own data. A failed server takes every disk inside it offline, so two copies on two disks in one server are still in one failure domain.
Rack and site
Servers in a rack often share power distribution and a top-of-rack switch. A site shares the building and usually its power, cooling and network entry. Spreading copies across racks or sites protects against faults at those levels.
Why does the choice matter?
Storage and scheduling systems place copies by failure domain. With the server as the domain, a storage system puts each replica or erasure-coded fragment on a different server. With the rack as the domain, each one goes into a different rack.
The same idea applies to services. A three-member etcd cluster keeps working with one member down, because two of three still form a majority. That only holds if no two members share a server. In Kubernetes, topology spread constraints spread pods across nodes or zones using node labels.
Hidden shared parts are the usual trap:
- Two servers on the same power strip or switch.
- Virtual machines that land on the same physical host.
- A single network uplink for a rack that looks redundant inside.
- One storage pool backing every replica of a database.
How enum handles failure domains
enum Object Storage uses erasure coding 4+2 with each fragment on its own server, six servers in one rack. Block storage acknowledges a write once it is on three failure domains, and each Kubernetes control plane is replicated across three. All of this sits in one zone, so keep a second copy elsewhere of data you cannot lose.
FAQ
Is a failure domain the same as an availability zone? No. An availability zone is one large kind of failure domain: one or more data centres in a region with their own power, cooling and network. Disks, servers and racks are smaller domains inside it.
How many failure domains do I need? One per copy or fragment, so no fault takes out two at once. Three replicas need three domains and a 4+2 erasure code needs six. A three-member etcd cluster in three domains survives one loss.
Does spreading across failure domains replace backups? No. It protects against broken hardware, not against deleted or overwritten data. A bad delete reaches every copy at once, so you still need versioning and a backup in another location.