Netflix has added single-tenant Titus, a mode that runs one task alone on its own right-sized EC2 instance, aimed at stateful, high-throughput streaming workloads where a neighbor's interference can lead to minutes of checkpoint recovery. The Compute/Platform team still owns and patches the host, so application teams keep the same API and deployment path.
Titus launches millions of containers a week across tens of thousands of EC2 instances and is multi-tenant by default. Netflix says cgroups, seccomp, the iocost controller and traffic shaping cannot split shared hardware such as the last-level cache and memory bandwidth, and its HTB traffic shaper takes a global lock: a container that floods the host with small packets can burn kernel CPU and starve its neighbors. Predictive CPU pinning and eBPF-based detection helped, but Netflix concluded that shared-kernel tuning narrows the gap without closing it.
Netflix rejected the alternatives for specific reasons. MicroVMs such as Firecracker and Kata need bare-metal or nested virtualization; nested virtualization was not ready on Netflix's instance types. They also meant running a hypervisor layer, added virtualization overhead and lacked GPU support. gVisor added overhead on I/O-heavy paths, and a single vendor does most of its maintenance. Running containers on EC2 would hand host patching and fleet sizing back to application teams. Netflix argues these workloads require performance isolation, not defense against hostile tenants.
The Titus federation layer does most of the work. An allowlist maintained by the Compute/Platform team controls eligibility and records which instance families a task may use; the autoscaler launches the smallest instance that fits the task's CPU, memory and GPU request; and pod anti-affinity, a non-preemptible priority class and a node taint enforce one task per node. Defragmentation is disabled, so nothing relocates the task. Netflix measures isolation by running a reference app alone, then beside a 'havoc' container, and scoring retained throughput and P99 latency; it published no scores.
The main cost is launch latency. A fresh instance needs tens of seconds to boot before the image pull begins. Warm pools help less than on the shared fleet because right-sizing produces many instance shapes, so Netflix keeps a small warm pool for the most latency-sensitive starts and limits the available sizes, dropping metal instances for these pools. Disabling Kubernetes preemption removed a scheduling bottleneck that left new nodes idle. Lazy image pulling (stargz, SOCI) and CRIU checkpoint restore are longer-term fixes.
Efficiency can improve. Moving sensitive workloads off shared hosts removes the anti-affinity spreading and disruption budgets that left those hosts partly empty, while fixed overhead from sidecars and system services pulls the other way: Netflix says it can cost a small instance tens of percent of its resources, and the largest shapes only a couple of percent. Discrete EC2 sizes also leave bin-packing gaps on large shared hosts, which favored right-sizing in practice.
Early users include managed Apache Flink, streaming data connectors, telemetry and logging pipelines, and some latency-sensitive GraphQL and edge services. The rollout continues. For the shared fleet, Netflix is working on eBPF-based Expected Departure Time shaping to replace HTB, plus cache and memory-bandwidth partitioning (Intel RDT, AMD PQoS), NVIDIA MIG, and the cgroup v2 IO controller. Its long-term goal is one Compute API that picks EC2 or Titus placement from declared intent.
Single-tenant Titus joins a broader set of approaches to the same problem. NTT's open-source Instance-per-Pod Webhook creates a tainted, dedicated instance for each pod; AWS Fargate makes the pod the unit of infrastructure; and both GKE and Azure offer Kata-based sandboxing, with GKE also offering sole-tenant nodes. Most of those target security isolation from untrusted code, while Netflix's mode focuses on performance isolation between trusted internal teams. Netflix recommends the pattern for large, long-running, disruption-sensitive workloads sized close to a node shape, not for small or bursty services, and the allowlist keeps the mode from eroding multi-tenant density.
Analysis
Why This Matters
- Netflix runs millions of containers a week, so how it isolates demanding workloads is a signal for the wider industry on the limits of shared-kernel isolation.
- The mode gives operators a concrete pattern: dedicated node pools with taints, anti-affinity and repacking turned off for large, disruption-sensitive workloads.
- The isolation comes with real costs in launch latency and density, so adoption choices will show which workloads genuinely need it.
Background
Container platforms commonly share physical servers among many workloads, which can let one busy or 'noisy' workload degrade the performance of neighbors competing for CPU caches, memory bandwidth and kernel time. Netflix built Titus as its container management platform, and multi-tenancy is its default. The new single-tenant mode is Netflix's answer for workloads that cannot tolerate that sharing.
What to Watch
- Whether single-tenant Titus expands beyond early adopters such as managed Flink, streaming connectors, telemetry pipelines and latency-sensitive GraphQL and edge services as the rollout continues.
- Netflix's long-term goal of a single Compute API that picks EC2 or Titus placement from declared intent, which would unify the two placement paths.
- Whether the shared-fleet work, including eBPF-based Expected Departure Time shaping and cache and memory-bandwidth partitioning, narrows the gap it says shared-kernel tuning could not close.
Checked
12 claims in this story checked against 1 source: 10 supported.
Show each claim
- SupportedNetflix added single-tenant Titus for performance isolation.InfoQ: “Netflix has added single-tenant Titus, a mode that runs one task alone on its own right-sized EC2 instance.”
- SupportedThe mode runs one task alone on its own right-sized EC2 instance.InfoQ: “a mode that runs one task alone on its own right-sized EC2 instance.”
- SupportedThe Compute/Platform team still owns and patches the host, preserving application teams’ API and deployment path.InfoQ: “The Compute/Platform team still owns and patches the host, so application teams keep the same API and deployment path.”
- SupportedThe mode is aimed at stateful, high-throughput streaming workloads where neighbor interference can lead to minutes of checkpoint recovery.InfoQ: “First adopters include stateful, high-throughput streaming workloads. Here, a neighbor's interference can lead to minutes of checkpoint recovery.”
- SupportedTitus launches millions of containers a week across tens of thousands of EC2 instances.InfoQ: “Titus launches millions of containers a week across tens of thousands of EC2 instances”
- Partly supportedThe allowlist controls eligibility and records which instance families a task may use.InfoQ: “An allowlist, maintained by the Compute/Platform team, controls eligibility and federation records, which instance families a task may use.”
- Partly supportedThe Netflix post publishes no scores for the isolation test.InfoQ: “To measure isolation, Netflix runs a reference app alone, then beside a "havoc" container, and scores retained throughput and P99 latency. The post publishes no scores.”
- SupportedThe test compares a reference app running alone with one running beside a “havoc” container.InfoQ: “To measure isolation, Netflix runs a reference app alone, then beside a "havoc" container”
- SupportedNetflix says its HTB traffic shaper takes a global lock, and a container flooding the host with small packets can burn kernel CPU and starve neighbors.InfoQ: “Its HTB traffic shaper also takes a global lock. A container that floods the host with small packets can burn the kernel CPU and starve its neighbors.”
- SupportedA fresh instance needs tens of seconds to boot before the image pull begins.InfoQ: “A fresh instance needs tens of seconds to boot before the image pull begins.”
- SupportedSidecars and system services can consume tens of percent of a small instance’s resources and a couple of percent of the largest shapes.InfoQ: “Netflix says it can cost a small instance tens of percent of its resources, and the largest shapes only a couple of percent.”
- SupportedBoth GKE and Azure offer Kata-based pod sandboxing, and GKE also offers sole-tenant nodes.InfoQ: “GKE offers sole-tenant nodes, dedicated physical servers that run only a single project's VMs, along with GKE Sandbox, which runs each pod in its own Kata Containers microVM. Azure’s Pod Sandboxing is also built on Kata”
