Cloudflare's Meerkat: A Global Consensus Service Without Leaders

Cloudflare's Research team has been building Meerkat, a new distributed consensus service that aims to solve a fundamental problem for the company's global control plane: how to maintain strong consistency across 330+ data centers without the availability hiccups that plague leader-based consensus algorithms like Raft.

Meerkat is powered by QuePaxa, a consensus algorithm published in 2023 by EPFL researchers. Unlike Raft, where a single leader handles all writes and a leader failure causes a timeout-driven election that can stall the system, QuePaxa allows every replica to perform writes at any time. Progress never halts due to timeouts, making it far better suited for wide-area networks with unpredictable latencies — exactly Cloudflare's environment.

The service is still experimental and internal-only, initially targeting small pieces of control-plane state such as leadership for replicated databases or placement information for AI model instances. But the implications are significant: if Meerkat proves out, it could replace Raft-based systems that have caused multiple incidents at Cloudflare due to unavailable leaders.

What Meerkat provides

Meerkat offers linearizability — the strongest form of consistency, where all reads after a write are guaranteed to see that write. This lets developers reason about distributed state as if it were local memory on a single-threaded machine, eliminating the mental overhead of weaker consistency models.

On the fault-tolerance side, Meerkat remains available for reads and writes as long as a majority of its machines are alive and can communicate. A single failed machine or degraded link won't take the system down. This is a direct improvement over Raft, where losing the leader can cause unavailability until a new leader is elected.

How it works

Developers request a cluster of Meerkat replicas, each connected to every other replica. Every replica participates in consensus and can accept both reads and writes. Clients send application-specific requests — like key-value get or put — to any replica. The replica translates the request into a log event, distributes it to all replicas via the consensus algorithm, and all replicas maintain the exact same log. Applications (like a key-value store) consume that log to build state.

Notably, even read requests create distributed log events to ensure linearizability. This is a trade-off: stronger consistency at the cost of additional coordination, but one that Cloudflare deems necessary for its control-plane workloads.

Bottom line

Meerkat is an ambitious attempt to bring leaderless consensus to production at global scale. If successful, it could become a foundational piece of Cloudflare's infrastructure, enabling strongly consistent control-plane state without the fragility of leader election. The team plans to share more details in future posts, but the direction is clear: Raft's timeouts are not the only way to build consensus.