Storage-domain control
One controller protects one shared bottleneck. Disk envelopes express minimums, maximums, and weights without creating competing feedback loops.
Protect the control plane from the storage queue.
Adaptive I/O protection for Proxmox VE hosts — bounded by storage domain, enrolled by exact disk, observable before it is allowed to act.
REFERENCE INCIDENT · ANONYMIZED
The pool was healthy.
The control plane was not.
A single bulk disk reached 115.36 MiB/s while shared ZFS write wait peaked at 348.87 ms. Capacity checks stayed green; SSH and durability-sensitive services did not.
25 ms target
12-second observed windowwrite wait
01Observelatency · PSI · queue · management
02Decideone bounded actor per storage domain
03Verifydesired ≠ effective until read-back
04Explainpolicy · evidence · reason · outcome
A guardrail, not an optimizer
Section titled “A guardrail, not an optimizer”Dry-run by default
Observer and shadow modes produce detections, proposed budgets, and a full explanation without mutating PVE.
Safe under uncertainty
Stale telemetry never increases a limit. Unknown effective state, policy drift, lease conflict, and read-back mismatch stop actuation.
Built for operations
Prometheus metrics, decision events, multi-signal alerts, replay, runbooks, and rollback make the controller inspectable under pressure.
What the first evidence says
Section titled “What the first evidence says”The offline reference replay evaluated 972 bounded AIMD policies. 198 passed a safety gate requiring no more unsafe seconds than a fixed 20 MiB/s limit in conservative, nominal, and optimistic models. The selected shadow candidate admitted 60.11–63.88% of modeled demand versus 59.26% for the fixed baseline, with the same modeled unsafe seconds.
PVE product, portable kernel
Section titled “PVE product, portable kernel”pve-storage-guard owns the operator experience, PVE discovery, packaging, and
constrained actuator boundary. The internal storage-slo-guard engine receives
platform-neutral observations and emits bounded proposals. Future Linux,
Kubernetes, or hypervisor adapters can reuse the engine without importing PVE
semantics into policy code.
PVE Storage Guard is an independent community project. It is not affiliated with, endorsed by, or sponsored by Proxmox Server Solutions GmbH.