TigerFS Isn't a Filesystem, It's a Promise of Determinism

A traditional filesystem promises you the file will be there when you need it. It doesn't promise that two runs of the same program, with the same input, will hit disk in exactly the same order, with the same bytes at the same offsets. For most systems I've worked on, that gap never mattered — logs land, backups run, nobody audits byte order. But the first time I debugged a race condition that only showed up on one specific disk controller, I understood why someone would want to kill that variability entirely. For a financial database that needs to reproduce a state byte-for-byte for audits or simulation testing, that gap is the whole problem.

That's where TigerFS comes in: the storage layer used by TigerBeetle, the financial accounting database written in Zig. It's not a general-purpose filesystem. It's a piece of engineering built to solve a very specific friction — and that narrow scope is exactly what makes it interesting.

What problem TigerFS solves in an embedded database

The concrete pain is this: when you embed the storage engine directly inside your process (skipping a general-purpose filesystem like ext4 or XFS), you lose all the POSIX guarantees you take for granted without thinking — write ordering, fsync atomicity, behavior during a mid-operation crash. A traditional filesystem gives you those guarantees, but with nuances that shift between kernels, between mount configurations, between versions. I've hit that exact shift firsthand: the same fsync call behaving differently between an ext4 mount with data=ordered and one with data=writeback was enough to turn a "should never happen" bug into a Tuesday. For normal debugging, that margin of variation doesn't matter much. For a system that needs deterministic simulation — the same run, the same bug, reproducible a thousand times — that variation is noise drowning out the signal.

TigerBeetle solves this with a particular approach: in its test suite, it replaces the real filesystem with a full I/O simulation that can inject disk failures, reorder writes, and force corruption in a controlled, repeatable way. TigerFS is the piece that makes simulated behavior and real behavior converge on the same guarantees, without the kernel throwing uncontrolled variables into the mix.

If you already read the post about Noroboto and its hype-free technical reading, the logic is similar: there's a low-level, specific problem that the usual generic tool doesn't solve — you need something built to spec.

What the official source says and what it doesn't say

TigerBeetle's GitHub repo is the primary source for all of this:

https://github.com/tigerbeetle/tigerbeetle

What the repo documents clearly:

• TigerBeetle is written in Zig, not Rust — I'm calling this out explicitly because it's a common mistake to assume Rust given the low-level systems ecosystem where this kind of design usually shows up.
• The project states determinism as a core design principle: the same sequence of operations produces the same state, always.
• It uses a simulation-based testing technique (sometimes called "deterministic simulation testing") where disk and network I/O get swapped for a simulated version that lets you reproduce the exact same failure scenario.
• The design targets a bounded use case: double-entry financial accounting, with a focus on durability and strict consistency.

What the repo doesn't say, and what's worth not making up:

• There's no public benchmark comparing TigerFS against ext4 or XFS on throughput or latency.
• There's no documentation claiming TigerFS is meant to replace a general-purpose filesystem.
• There's no public evidence that this design scales as a generic solution outside TigerBeetle's context.

That distinction between what the source claims and what you could enthusiastically infer is exactly where poorly-grounded hype tends to start.

Where people get this kind of design wrong

The common recipe when someone reads about a system like this is: "hey, this total-determinism thing sounds better than what I've got, let me apply it to my project." The hidden cost shows up fast.

A deterministic filesystem like the one TigerFS's design describes assumes a very particular context: an embedded storage engine, with full control over the on-disk data layout, with no need to interoperate with other applications also writing to that same filesystem. That's exactly what a single-purpose financial database needs. It's not what a typical backend needs — one that serves static files, logs to disk, and shares the filesystem with fifteen other processes.

The clearest counterexample: if your system needs broad POSIX compatibility — third-party tools, standard backups, mounting across different environments — building or adopting something with this philosophy solves a problem you don't have and creates one you didn't have before: maintaining a piece of non-standard infrastructure.

flowchart LR
  A[Necesito storage embebido] --> B{¿Necesito reproducir estado exacto ante fallas?}
  B -->|sí, es crítico| C[Evaluar diseño determinístico dedicado]
  B -->|no, o es nice-to-have| D[Filesystem estándar + testing convencional]
  C --> E[Costo: mantenimiento de pieza no estándar]
  D --> F[Costo: menos control sobre orden exacto de I/O]

Decision matrix: when to look at this kind of design

This matrix isn't a closed formula. It's a sensible starting point so you don't buy into the design without checking whether the problem it solves is the problem you actually have.

Limits: what can't be concluded from this evidence

None of these claims are backed by the public repo, so I'm not going to hold them as if they were:

• I can't claim TigerFS is faster or slower than a traditional filesystem — there's no public benchmark measuring that.
• I can't claim this approach applies outside TigerBeetle's specific context without evidence of an equivalent proven use case.
• I can't claim it's "the future of storage" — it's an engineering piece scoped to one domain, not a general industry trend.

If someone wants to validate the deterministic behavior in practice, the right path is to run the repo's test suite locally with Docker, review the failure simulation logs, and compare the reproduced behavior against what's documented — not infer it from a tweet with a screenshotted graph.

My take

My thesis: TigerFS isn't competing with ext4, and framing it that way is the fastest way to misjudge it. Its value comes precisely from refusing to be generic. It's a piece built for a real, bounded friction: when you need a bug to reproduce exactly the same way a thousand times, a general-purpose filesystem with its kernel and configuration variations becomes the enemy, not the solution.

What I don't buy is the instinct to grab this kind of design because it sounds more "correct" than what you're running. Determinism at the filesystem layer is a tool for a specific domain, not a maturity badge.

If you're building a system with strong consistency requirements similar to financial accounting, it's worth studying the approach in detail before dismissing it as "niche systems stuff." If you're building anything else, stick with the standard filesystem and handle determinism at the application's testing layer — it's cheaper, and you'll be able to maintain it without depending on a piece of infrastructure that few people understand.

The same logic of "pick the right tool for the right problem, without buying into the hype" applies when you're deciding between stateless JWT and stateful sessions, or when you're evaluating whether you need Server Actions to solve mutation without solving cache. The pattern repeats: the question is never "is this better in the abstract?", it's "is my problem the problem this thing solves?"

FAQ

Is TigerFS a filesystem you can mount like ext4 or XFS?
There's no public evidence it's meant for use as a mountable, general-purpose filesystem on any system. It's a storage layer designed for TigerBeetle's specific context.

Is TigerBeetle written in Rust?
No. TigerBeetle is written in Zig. Worth clarifying because the low-level systems ecosystem tends to automatically get associated with Rust.

What does "determinism" mean in this context?
That the same sequence of operations, run under the same conditions, produces exactly the same final state — with no variation introduced by OS I/O ordering or the scheduler.

Does this approach work for traditional SQL databases?
There's no public evidence of that. The design addresses one specific use case (double-entry financial accounting) and isn't documented as a generic solution for SQL engines.

How do you test deterministic behavior without access to production?
By running the project's test suite locally with Docker and reviewing the failure simulation scenarios the repo documents. That gives you reproducible proof without needing production data.

Is it worth adopting this philosophy on a small project?
Generally, no. The maintenance cost of a non-standard piece of infrastructure usually outweighs the benefit if your domain doesn't demand exact reproducibility under disk failures.

Original source: https://github.com/tigerbeetle/tigerbeetle

This article was originally published on juanchi.dev