PGKeeper: Building the bouncer we needed for Postgres

Figma outgrew PgBouncer due to its single-threaded architecture, lack of load management, and limited extensibility. They built PGKeeper, a Go-based gRPC service that replaces PgBouncer as the connection pooler in front of their Postgres fleet. PGKeeper introduces pool warming, token-bucket rate limiting for connection creation and teardown, connection churn avoidance (bounded exhaust, auto rollback, context cancellation handling), and a two-stage admission control system. The first stage uses a priority-based semaphore with CoDel and adaptive LIFO scheduling; the second uses a weighted min-max fair sharing tree across multiple traffic dimensions. Rollout used incremental deployment ordered by criticality, load testing at 3× peak QPS, and an automatic error detector that could flip traffic back to PgBouncer. Since full rollout, Figma's database SLO has held above 99.99%, with PGKeeper preventing over 20 user-visible incidents in Q4 2025 alone.