Larry Peterson Princeton University Timothy Roscoe Intel Research Berkeley
PDN–04–021 June 2004 (updated January 2006)
Appears in Operating Systems Review, 40(1):11-16, January 2006
The Design Principles of PlanetLab
Larry Peterson Princeton University
Timothy Roscoe Intel Research – Berkeley
PlanetLab is a geographically distributed platform for deploying, evaluating, and accessing planetary-scale network services. PlanetLab is a shared community eﬀort by a large international group of researchers, each of whom gets access to one or more isolated slices of PlanetLab’s global resources. Because we deployed PlanetLab and started supporting users before we fully understood what its architecture would be, being able to evolve the system became a requirement. This paper examines the set of design principles that guided this evolution. Some of these principles were explicit at the project outset, and others have become crystallized as the platform has developed.
umentation of large systems to include an attempt to reﬂect on the thought processes of its architects, David Clark’s description of the Internet design philosophy  being one notable example. The evolving design of PlanetLab has been an attempt at principled pragmatism. The principles we present here did not, in general, predate the implementation of PlanetLab, though some were explicit from the outset. Instead, they have co-evolved with the architecture itself, and thus we expect them, like the architecture itself, to continue to change over time.
Underlying the design principles are the high-level goals of PlanetLab. From the beginning , we have identiﬁed three: • to provide a platform for researchers to experiment with planetary-scale network services; • to provide a platform for novel network services to be deployed and serve a real user community; and • to catalyze the evolution of the Internet into a service-oriented architecture. It should be clear that these goals are highly synergistic and reinforcing: early experiments with ideas lead to the deployment of new network services, and the availability of a rich set of network services eﬀectively changes the nature of the Internet. There are, however, subtle tensions between the three. For example, a platform that supports only short-term experiments would likely be designed diﬀerently than one that must also support continuously-running services. We hope to support both workloads, but with a bias towards the latter. Similarly, a platform that supports a collection of services developed by the research community need not necessarily consider the full range of scalability, security, and autonomy issues that must be addressed by a platform which aspires to become the conduit through which users interact with the Internet. The balance-point between these two goals is diﬃcult to
PlanetLab is a globally distributed computing platform shared, built, and maintained by a community of researchers at 300 sites in more than 30 countries. In exchange for hosting a small number of nodes (servers), participants obtain access to a share of resources across the entire platform for deploying and evaluating planetaryscale network services . In addition, the platform itself, including the essential services required to operate it, is a communal design work in progress and an interesting research area in its own right. In this paper we concentrate on the design principles of PlanetLab. By “design principles”, we mean the rules we have come to recognize and formulate that guide our decisions about how to put the platform together. In contrast, we use the term “architecture” to denote the composition of the platform itself, in other words the end result of these decisions. We do not describe PlanetLab’s architecture in this paper other than to illustrate the consequences of our design principles. The architecture of the...