Introduction to Fn Project’s Function Limits

My alternative title was Fn Project’s Bitcoin Mining Defense System.

Service charge per execution time is a distinguishing feature in a function as a service (FaaS) platform since functions are expected to only run during handling of individual requests. This is an attractive pricing model.

Fn offers hot functions feature to keep a spawned function running after initial request. This translates into faster response time for any subsequent requests.

If these hot functions are kept running in the system, how are they prevented from running tasks in the background and bypass Fn platform billing & accounting?

First some basics: CPU and Memory limits

First line of defense against a single function consuming too many resources is configuring CPU and memory. This is easily achieved by adding these settings in the function file (func.yaml):

name: fnproject/hello
version: 0.0.1
type: sync
format: json
memory: 128
cpus: 100m
idle_timeout: 600

The above configuration limits this function to 10% of a CPU core (100 milli-cpus) and 128 MB of RAM.

The idle_timeout means this function will terminate after 600 seconds if no request is processed during this time.

Can these hot functions continue consuming 10% of a CPU core after processing a quick request for the remaining idle time?

Enter Fn Scheduler: Hot but frozen functions

We have added the freezer feature in Fn to prevent unaccounted resource consumption. While these hot functions are kept resident in the system, the actual function processes are frozen (paused) if they are not actively processing any requests.

On Linux systems, this is enabled by default.

It turns out unfreezing these functions is much faster than creating new function. Hot functions still perform better than cold functions even with freezing and unfreezing.

Conclusion: Set your limits and Fn handles the rest

In summary, hot functions can only consume resources within their configured CPU & Memory limits and they are frozen unless actively handling a request. Therefore, it’s not possible for hot functions to run any background jobs (no more bitcoin mining.)

Questions? Comments?

To learn more about the Fn Project, visit our blog at fnproject.io, watch our demos at YouTube, and join the community at Slack.