Disk cache none...safe or not safe?

[SteveITS]

I was reading https://pve.proxmox.com/wiki/Performance_Tweaks#Disk_Cache. And I'm pretty sure I've seen another PVE doc listing none/no cache as "safest" but am not finding it right now. :-/ In general most posts I find say "none" is safest.

In the Wiki, none is described as "balances performance and safety (better writes)." However right underneath that, it says:

• "guest disk cache is set to writeback
• Warning: like writeback, you can lose data in case of a power failure"

Writeback adds only, "host page cache is used as read & write cache."

So what exactly makes "none/no cache" safer than "writeback," if both use a writeback cache?

(I am not asking about "writeback (unsafe)".)

 

[readyspace]

You're absolutely right to question the safety differences between "none" and "writeback" cache modes — the terminology can be confusing, especially with how the Proxmox wiki phrases it.
To clarify:
"None" (or "No cache") is generally considered safer than "Writeback" because:

• With cache=none, the guest OS communicates directly with the disk image, bypassing the host's page cache entirely. This reduces the chance of data being silently lost due to host-level buffering.
• In contrast, cache=writeback uses the host's page cache. This means the guest OS may think data has been safely written (e.g., after an fsync()), but it could still be sitting in the host’s RAM — and lost in a power outage.

Breaking it down:​

When a guest VM issues a write, two layers handle caching:

1. The guest disk cache (e.g., Linux using ext4, with journaling and fsync)
2. The host-level cache (controlled by the Proxmox/QEMU cache mode setting)

Cache Mode Summary:​

Cache Mode	Host Page Cache	Guest Perception	Risk Level
Writeback	Yes (Read + Write)	Fast	Higher risk — host may buffer writes
Writethrough	Yes (Read only)	Slower but safer	Safer than writeback
None	No (Direct I/O)	Guest controls	Safest — guest manages integrity directly

Why is "none" safer?
Even though the guest may appear to be using a "writeback" disk cache (as shown in /sys/block/sdX/queue/write_cache), the host is not buffering the data when using cache=none. The guest OS must manage disk write consistency itself — and if it uses proper mechanisms (like journaling and fsync), those writes go straight to disk with no silent buffering from the host.
This setup significantly reduces the chance of unexpected data loss during events like power failures.

 

[leesteken]

• In contrast, cache=writeback uses the host's page cache. This means the guest OS may think data has been safely written (e.g., after an fsync()), but it could still be sitting in the host’s RAM — and lost in a power outage.

Slight nitpick: writeback should honor flushes (like fsync) and only buffer async writes. That's what differentiates it with writeback(unsafe) which fakes flushes and also buffers sync writes.

 

[Impact]

@readyspace Sorry but that kinda sounds exactly like what a AI/LLM would say.

 

[chrcoluk]

So from the link the OP posted.

DirectSync is the safest, but expect trash performance. No host side caching, all writes sent to to disk force flushed, even if they are async.

The None option is the default and most sane option, if using ZFS it wont use the page cache at all, will use ZFS ARC for reads, will use ZFS dirty cache for async writes which by default will flush no later than 5 seconds, flush/sync writes are honoured, so will go to ZIL directly, and then force flushed to disk.

Writeback uses the page cache for async, so you double caching on ZFS, writes delayed longer, even if sync flushes are still honoured.

Bear in mind, the guest OS could be configured in a way that is at complete odds to the host side. The proxmox configuration is for the host.

 

[SteveITS]

Hmm, thanks.

What about other storage like Ceph?

It seems the difference lies between:

• host page cache is not used
• guest disk cache is set to writeback

and:

• host page cache is used as read & write cache
• guest disk cache mode is writeback

I also see now there are small pictures on the far right of the wiki page...I honestly think I zoomed in on my phone and didn't see them. Looking at those, it seems much clearer that the None writes are using the disk's hardware cache, and the Writeback writes are using the host/Proxmox cache. So I guess None is still "dangerous" in that the write may be at the disk but not written to the disk at the time of power loss.

 

[leesteken]

So I guess None is still "dangerous" in that the write may be at the disk but not written to the disk at the time of power loss.

There is no way around this and you'll have to trust your hardware. Or buy hardware that give you the guarantees that you want. Enterprise SSDs with PLP do give me the guarantee that flushes and sunc writes will be written to disk even when the power goes off. Hardware RAID controllers with a battery (BBU) also give similar guarantees.

 

[SteveITS]

Right. I guess I just had to work through the difference between writeback and writeback.