What happens if the underlying infrastructure has an outage?

Summary

• It depends on the scope of the outage. A single cloud availability-zone failure is handled automatically inside the region; a full regional outage is addressed with a disaster recovery plan.
• Zonal outages fail over automatically. The Databricks control plane runs across multiple availability zones and recovers into a healthy zone, with failover that typically completes within about 15 minutes and no data loss (a 0 recovery point objective) for zonal failures.
• Compute keeps running. Serverless compute provides multi-zone failover with no configuration, and Databricks replaces VMs lost to a zonal outage; for jobs, the cluster manager restarts the job and cluster, in a different zone if needed.
• Data stays durable. Delta Lake ACID transactions protect data integrity during failures, and data on regional cloud object storage is redundant across zones.
• Regional outages use disaster recovery. Choose a DR pattern (active-passive, active-active, or backup and restore), or use Databricks Managed Disaster Recovery to replicate workspace assets and Unity Catalog metadata to a secondary region.

What happens if the underlying infrastructure has an outage?

What happens depends on the scope of the outage. Cloud infrastructure is organized into availability zones within a region, and regions themselves. Databricks handles a single-zone outage automatically inside the region through built-in high availability, while a full regional outage is addressed with a disaster recovery (DR) plan you design ahead of time. In both cases, your data on cloud object storage remains durable. See Design a high availability strategy.

Why the Databricks Platform stays available during an outage

• Automatic zonal failover for the control plane. The Databricks control plane runs across multiple availability zones, and its core services are multi-zonal. If a single zone fails, the control plane automatically recovers services into a healthy zone and keeps operating. This failover is automatic, typically completes within about 15 minutes, and results in no data loss (a 0 recovery point objective) for zonal failures. This applies to cloud regions that have multiple availability zones. See Intra-region high availability guarantees.
• Serverless compute fails over on its own. With serverless compute, you do not select zones. Databricks manages zone selection for the VMs and automatically replaces VMs lost to a zonal outage, and the default storage it manages requires no action to prepare for or recover from a zone failure.
• Classic compute distributes across zones. For classic compute, you deploy workspace subnets across at least two availability zones (three recommended), and Databricks distributes cluster nodes across those zones. If a driver node is lost, the cluster manager restarts the job and cluster; if an entire availability zone fails, it restarts the job and cluster in a different zone.
• Durable data on cloud object storage. Delta Lake provides ACID transaction guarantees that protect data integrity during failures. Data stored on regional cloud object storage is held redundantly across zones, and the DBFS root is not affected by a zone failure. For cross-region protection, Delta Deep Clone replicates Delta tables in full, and cloud provider geo-redundant replication covers other files.
• Disaster recovery for regional outages. For a whole-region outage, you use a DR strategy. The three common patterns are active-passive (a standby secondary region with periodic replication), active-active (both regions serving traffic with near-real-time replication), and backup and restore. Databricks Managed Disaster Recovery can replicate workspace assets such as notebooks, jobs, SQL warehouses, clusters, and ACLs, along with Unity Catalog metadata, to a secondary region on a continuous schedule. It offers an optional stable URL that always points to the current primary, so clients keep working after a failover, and it lets you initiate failover at a time of your choosing while keeping the secondary read-only until it is promoted.

Getting started

• Read Design a high availability strategy and choose regions with multiple availability zones.
• For classic compute, spread workspace subnets across at least two (ideally three) availability zones so nodes distribute automatically.
• Define your recovery objectives and pick a DR pattern in Design a disaster recovery strategy.
• Evaluate Databricks Managed Disaster Recovery for continuous replication to a secondary region, and test recovery procedures using the reliability best practices.

FAQs

What happens during a single availability-zone outage?

The control plane automatically recovers into a healthy zone (failover typically completes within about 15 minutes with no data loss for zonal failures), serverless compute fails over automatically, and for jobs the cluster manager restarts the job and cluster in another zone.

Is my data lost if the infrastructure has an outage?

No. Delta Lake ACID transactions protect data integrity, and data on regional cloud object storage is stored redundantly across zones, so a zonal failure does not lose it.

What happens if an entire cloud region goes down?

A full regional outage is handled with a disaster recovery plan: an active-passive, active-active, or backup-and-restore pattern, or Databricks Managed Disaster Recovery, which replicates workspace assets and Unity Catalog metadata to a secondary region.