It was just another day at the office in 2019 when we first read the paper that would set the course of our future careers. My cofounders and I were no strangers to reading the occasional research paper--I had originally joined their team at CoreOS because I had read the Raft paper and discovered etcd. But there was something about this paper in particular: it laid out the solution to major problems we were having at the time.
Our container registry product, Quay, had scaled quite far, but we'd reached the limits for our existing strategy for authorizing API requests:
- The majority of our database CPU usage was performing
JOINs necessary for checking permissions - Our authorization library was complex, brittle, and had to be audited before a change could ship
- We had feature requests that could only be accomplished by writing a new authorization system
- We had no strategy for sharing authorization code and data with new services
A year later, we quit Red Hat, who had acquired CoreOS, to return to start-up life. It was obvious to us what we'd work on next.
It's been 3 years since the fateful day we read that paper and two years since we left to start a company around it. As we wrap up 2022, I think it's important to pause and reflect on all that's been accomplished. I honestly still can't believe how far we've come and I'm both incredibly proud and humbled by everyone involved. I'd like to personally thank not only our team, but also everyone in our community.
In 2022, SpiceDB had a ton of major developments:
- Triple the number of releases
- Support for Cloud Spanner as a datastore
- Support for MySQL (e.g. MariaDB, Vitess) as a datastore was contributed by the GitHub Authorization team
- Dramatic performance improvements for the Postgres datastore
- A new compilation target: WebAssembly (which now powers the Playground)
- An additional API, LookupSubjects, to find all of the subjects with a permission
- Even deeper integration with Kubernetes via the SpiceDB Operator
- Caveats: dynamic policies that scale
As well as the community:
- The number of Discord users quadrupled
- Our GitHub organization now has a bunch of followers and SpiceDB doubled its stargazers
- Thousands of questions were asked and answered (mostly on Discord, but also on GitHub Issues and even StackOverflow)
- Hundreds of user stories were documented and represented for various feature proposals
- We remained true to our roots by joining the Cloud Native Computing Foundation extending our community
- SpiceDB maintainers successfully exercised our security policy with our first CVE and documented the experience for others to learn, too
- An Awesome List was created to chronicalize all the awesome new community projects
- An examples repository was created so folks could contribute example setups for various environments
And finally our company:
- We launched zanzibar.tech, our annotated love letter to Google's Zanzibar paper
- We're honored to have Brad, Victor, and Damian join the team
- We had an annual off-site event in upstate New York
- We built and launched SpiceDB Dedicated on AWS and GCP
- SpiceDB Serverless SREs managed their first critical incident whose post-mortem contributed to better understanding for both maintainers of SpiceDB and the Go runtime
This is quite the list of accomplishments, but what would be an annual wrap-up without posting some predictions? I decided to collect one prediction from each of us on the team:
- Jimmy: Databases that support edge/mutli-region (like SpiceDB) will become table-stakes for building new applications.
- Jake: More products will say that they’re “Zanzibar inspired” while continuing to miss the mark.
- Joey: The year of the WASM application
- Sam: The sudden disappearance of “Lorem Ipsum” placeholders
- Brad: Platform Engineering will continue to gain cultural importance in DevOps / SRE circles.
- Victor: we get the first AI-generated short movie
And with that, that's a wrap! From our team, happy holidays and have a great new year!
