Move Fast and Migrate Things: How We Automated Migrations in Postgres

[Daishiman]

I am convinced that data migration is definitely one of the hardest problems in data management and systems engineering.

There are basically no solutions today that satisfy fundamental requirements such as minimizing downtime and guaranteeing correctness.

It is _such_ a huge problem that most inexperienced developers see kicking the problem down the line with NoSQL document storage as a viable alternative (it isn't; you'll be either dealing with migrating all data forever and special-casing every old version of your documents, or writing even more convoluted migration logic).

It's also clear that even the most modern ORMs and query builders have not been built in mind to consider the issues that arise in migrating data.

It would be a refreshing thing to see more research devoted to this problem. Unfortunately, migrations end up being so different from each other with such heterogenous requirements that we'll probably be working on this for a really long time.

[rabi_penguin]

I recently discovered anchor modeling [1], which forms the relational underpinnings of sqlalchemy-continuum [2], which I haven't used but I'm quite curious about. I've done ad-hoc, manual versions of anchor modeling for most data migrations I've done in my career, and I agree with you on how hard it is. It's high risk, difficult to verify, and repair work after the fact if a botched migration happens is also expensive. With diligence and enough resources though, it is doable. But, it could be a lot easier.

I think that more sophisticated static analysis and migration generation tools would really help out quite a bit in making this a reality, especially if you combine it with something. Having something like rope[3] for generating migrations and hypothesis[4] for using property-based testing to generate tested cases would make things nice as well. Definitely a hard problem, and definitely a worthwhile one to solve. If our team ever gets some free time to build a toolkit, we'd enjoy building some tooling to put all of this stuff together!

[1] https://en.wikipedia.org/wiki/Anchor_modeling

[2] https://github.com/kvesteri/sqlalchemy-continuum

[3] https://github.com/python-rope/rope

[4] https://hypothesis.readthedocs.io/en/latest/

[dcosson]

I think DB's could definitely do more to expose what the cost of various operations are, it would be great if you could "explain" a migration before you run it like you can with a query and it would calculate a rough cost, how many rows need to be touched, what resources need to be locked, even how likely the required locks are to cause contention with other frequently-taken locks based on system statistics, etc.

But I was thinking about this recently and I feel like theres's some low hanging fruit in the migration frameworks themselves which, at least as far as I'm aware, all just completely punt on this problem. Rails, Alembic, and every other framework I've used will let you write a migration like adding a new non-nullable column, or renaming an existing column, things that can be really slow on a big or frequently written table and/or will cause problems during the rollout if an old version of the code is still running. It doesn't seem like it would be that hard to add a safe mode where the framework will block at least some of the most common variations of these unsafe migrations. Maybe it's harder than I realize, or maybe it's just a matter of anyone opening up some PR's and actually implementing this.

[zepolen]

Migrations in a strict relation database always guarantee correctness. It's the need to roll back that causes issues.

That is solved by not doing destructive changes (removing a column) until the software is stable and a few iterations have passed.

The issue of downtime is semi-valid but can likewise be worked around by batch migrating data in manageable chunks vs nuking.

[JamesSwift]

I don't know, at my current job I've been introduced to DACPACs[1] and I really like it. The ability to do schema/data compares between arbitrary environments and generate the migrations in real time is awesome.

[1] - https://docs.microsoft.com/en-us/sql/relational-databases/da...

[emmelaich]

Category theory to the rescue -- as always!

http://math.mit.edu/~dspivak/informatics/FunctorialDataMigra...

[rb808]

Amen.

Tools that let you work with version A and B of a db schema would be great.

Then you could update DB independently of code release. Its one of the things that I fear the most (and prevents me from loving RMDBs) is the thought of doing a big DB upgrade then having to roll back because of software not performing as expected.

[mcintyre1994]

> NoSQL document storage as a viable alternative (it isn't; you'll be either dealing with migrating all data forever and special-casing every old version of your documents, or writing even more convoluted migration logic).

In practice (with Mongo at least) you end up with migrations being from arbitrary JSON to different arbitrary JSON, and come to rely on the Javascript runtime for anything even a bit complex. It's definitely convoluted (albeit extremely powerful), but I think the biggest issue is that generating backward migrations even if you did non-destructive operations is completely impossible.

[djrobstep]

Strongly agree with this.

So much so that I wrote a schema comparison tool that allows you to autogenerate migration scripts and explicitly test for correctness.

Schemas are good, but the traditional tooling around changing them (rails/django migrations) is really bad. People inevitably cut corners because it's too hard to do things the right way.

[Scarbutt]

You say NoSQL document but have you work with graph databases like neo4j that allow for flexible schemas? I think they mostly solve this problem but don't have the uptake of RDBMs because of matureness.

[existencebox]

This is an amazing writeup. I'm currently solving the "migrations" problem for a side project of my own, and have basically resolved myself in the short term to be OK with short downtime for the sake of making migrations somewhat trivial.

And honestly? I hate this answer. As a solo dev it's pragmatic, but the solutions described in this article are _SO NICE_ that I'd love to leverage them.

If there's any way that those deprecate_column and rename functionalities could make their way into OSS/upstream support, I'd have a field day. (Those who know more about PG than I do and perhaps may be able to suggest another workaround, feel free, I'm very much learning this space as I go)

If nothing else, thanks to the benchling team for taking the time to write such a clear yet technical expose. This really hit the sweet spot of "explanations without uneccessary verbosity, technical without being impenetrable, and giving sufficient explanations of motivations and tradeoffs/pitfalls" and will give me a north star for where I aim my own DB work.

[vineetg]

Original author here. Thanks for the kind words!

We would love open source some of the work we did - there are a few edge cases to still work out with deprecated_column and renamed_to before I’d be comfortable doing that, but definitely agree that may be generally useful.

[ThePhysicist]

In our startup we moved away from Alembic to using plain SQL files for migrations, which (in our experience) is more robust and allows more control over the actual migration process. We wrote a simple migration manager class that loads a YAML config and a series of SQL files from a directory. Each migration is defined as two files of the form "[number]_[up/down]_[description].sql" and tied to a DB version, the YAML config specifies the name of a version table that contains the current version in the database. The manager then reads the current version from the table, compares it to the requested one and executes the necessary SQL files.

Alembic is great for many simple use cases but we found that for a production system it often isn't easy to maintain compatibility between two different DB systems like Postgres and SQLite anyway, as that would mean either adding a lot of feature switches and custom logic to our code or not using most of the interesting native Postgres features. Therefore Alembic offered very little benefit over a plain SQL file in terms of functionality and in addition made it harder to generate correct migrations in some case, as the auto-generation process does not work very reliably in our experience and some things are buggy/inconsistent, e.g. the creation and deletion of enum types. In addition, we found that it's much easier to write complex migration logic (e.g. create a new column and populate it with data from a complex SELECT statement) directly in SQL. Last point is that we can of course execute these migrations using any programming language / tool we like (for example we also wrote a small Go library to handle the migrations), which is a nice bonus.

That said we also heavily use SQLAlchemy in our Python backend code and like it a lot.

[theptip]

This covers a lot of ground that I've recently had to learn the hard way.

One item I've been considering; under Downtime, a reason for flakes in migrations is "long running transactions".

I've seen this too, and wonder if the correct fix is actually to forbid long-running transactions. Typically if the naive long-running transaction does something like:

    with transaction.atomic():
        for user in User.objects.all():
            user.do_expensive_thing_to_related_objects()

You can often recast that migration to something more like

    for user in User.objects.all():
        with transaction.atomic():
            user = User.objects.get(id=user.id)  # Read the row to lock it; or do a SELECT FOR UPDATE
            user.do_expensive_thing_to_related_objects()

This example is somewhat trivial, but in most cases I've seen you can fetch your objects outside of the transaction, compute your expensive thing, and then lock your row for the individual item you're working on (with a sanity-check that your calculation inputs haven't changed, e.g. check the last_modified timestamp is the same, or better that the values you're using are the same).

I've considered simply configuring the DB connection with a very short connection timeout (something like 5 seconds) to prevent anyone from writing a query that performs badly enough to interfere with other tables' locks.

Anyone tried and failed/succeeded in making this approach work?

The other subject that's woefully underdeveloped is writing tests for migrations; ideally I want to (in staging) migrate the DB forwards, run all the e2es and smoke tests with the pre-migration application code, migrate back (to test the down-migration), run the e2es again, and then really migrate forwards again. That would cover the "subtly broken deleted field" migration problem.

But how do we test that our migrations behave correctly in the face of long-running transactions? I.e. what's the failing test case for that bug?

[pas]

> But how do we test that our migrations behave correctly in the face of long-running transactions? I.e. what's the failing test case for that bug?

Isn't it enough to simply make sure the migration transaction successfully finished? Even if there is a long running transaction, if the migration finished, that long tx will get aborted and rolled back.

Or if the migration stalls because the long running tx, then you'll presumably get a timeout error.

Is there something I'm missing?

[zepolen]

No,

  with transaction.atomic():
    for user in db.users.all():
      user.do()

is not the same as

  for user in db.users.all():
    with transaction.atomic():
      user.do()

If the first fails, the entire data rolls back, if the second fails, half your db might be in an inconsistent state.

[ngrilly]

Great post. I agree that we don't need automated post-deploy migrations. We just need automated pre-deploy migrations. Post-deploy migrations, for example to delete an unused column, can be implemented as pre-deploy migrations in a subsequent commit.

[Ixiaus]

You can also automatically generate some migrations with a proof search in linear logic, the way the beam[1] project does.

[1] https://tathougies.github.io/beam/schema-guide/migrations/#a...

[benmmurphy]

In postgresql if you are using prepared statements and are doing a 'select star' and drop or add a column then the prepared statement will start failing. This is kind of bad when you are doing transactions because the bad statement will taint your transaction and you will need to restart from the beginning. Select star is incompatible with prepared statements and postgresql which might also explain why SQL Alchemy explicitly names columns in select statements. Rails will do 'Select star' so prepared statements are the first thing I turn off in Rails/Postgresql projects. [Maybe they have a fix now?]

[pas]

> This is kind of bad when you are doing transactions because the bad statement will taint your transaction and you will need to restart from the beginning.

Why is this bad? Can you handle this on the application side somehow? Even if it just means restarting Rails when the migration has finished.

Or the problem is that you want 0 downtime and 0 UX impact migration?

[wwweston]

How did it come to be that some portion of the industry use the term "migration" to describe changes/updates to a database?

As far as I can tell, it's a really poor fit. It generates the expectation that movement of existing schema + maybe data from one host to another or one environment to another. What's usually happening instead is essentially a schema diff / mutation.

[Ixiaus]

Because when you change the representation of data at rest, you need to "migrate" that data to the new representation.

I agree that schema changes are not migration, but I think the author correctly uses the word "migration" to mean migrating their data in the database to some new schema representation.

[pas]

I guess it is because you migrate data between application versions. And sometimes this means simply applying an SQL script file, sometimes you also combine this with upgrading the DB server itself, then you might also need to do the whole export-import dance (async replication + export-upgrade-import on a secondary instance, then promote that instance and either drop the old and create a new secondary, or do the same exp-imp on the old-primary).

Good question though, it could be "schema upgrade", but sometimes there's a downgrade, so somehow people started calling it migration.

And it's especially important to note, that users don't care about the schema, operators care a bit, developers slightly more, and if there is a dedicated DBA in the loop, now that person might finally really care about it, but they rarely write the migration scripts. And developers care about data. (At least that's my impression.)

[aidos]

The word “replication” is used when replicating the data from one location to another. Maybe it depends on your industry but everywhere I’ve worked in software, migration has meant changing the schema and data and replication has meant moving to to another location.

I do agree that the terminology could be better, but it seems to be fairly standardised now.

[danielbigham]

These are the types of challenges I've been thinking about for the last year -- nice to be able to read the approach taken by others.

[bayesian_horse]

I'm totally in love with Django's way of migrating databases.

It's not for every project, certainly, and you sometimes need to work around limitations of the ORM. And of course some people don't like ORMs in the first place.

[seanwilson]

Anyone else hold back on releasing side projects because having to do data migrations with stored user data prevents you from being able to aggressively refactoring your code? Is there a good compromise for this?

[pas]

If the side project is "small", then the migration can be done in a few hours tops, so user impact is probably negligible. Have you encountered a more severe problem maybe?