Netflix Chaos Monkey
By Netflix
Chaos Monkey is an open-source resilience testing tool, originally built by Netflix, that randomly terminates virtual machine instances or containers within a production environment during business hours to force engineering teams to build…
Definition
Chaos Monkey is an open-source resilience testing tool, originally built by Netflix, that randomly terminates virtual machine instances or containers within a production environment during business hours to force engineering teams to build systems that tolerate unexpected instance failure. It is the original tool in what became the broader Simian Army family and is widely credited with popularizing the discipline of chaos engineering.
Overview
When Netflix moved its infrastructure to Amazon Web Services in the early 2010s, engineers recognized that individual cloud instances would fail unpredictably and that traditional testing rarely uncovered how services actually behaved when that happened. Chaos Monkey was built to make that failure mode a routine, expected event rather than a rare surprise, on the reasoning that a service which cannot survive losing a random instance during a Tuesday afternoon is not actually production-ready, no matter how it performs under normal conditions. Mechanically, Chaos Monkey runs on a schedule during defined business hours, selects a random instance from a configured group of services opted into testing, and terminates it, then relies on existing monitoring and alerting to reveal whether the surrounding system degraded gracefully or caused a visible failure. It deliberately avoids testing outside business hours specifically so that any gaps in resilience are caught while the team best equipped to respond is on hand, rather than at 3 a.m. Netflix later open-sourced it and it became the first and most well-known member of the Simian Army — a set of related tools like Latency Monkey and Conformity Monkey that tested other failure and compliance dimensions. Chaos Monkey is best understood as the historical origin point of a category that later diversified into more sophisticated tools: Kubernetes-native platforms like Chaos Mesh and LitmusChaos, and commercial platforms like Gremlin, all extend the same core idea to a much wider range of fault types beyond simple instance termination, such as network latency, resource exhaustion, and DNS failure, with finer-grained targeting and safety controls. Chaos Monkey itself remains comparatively narrow in scope, focused specifically on instance and container termination. In practice, teams that adopt Chaos Monkey do so to build organizational confidence that auto-scaling groups, load balancers, and retry logic actually work as designed rather than merely as documented, and to normalize failure as a routine engineering concern rather than an emergency. It is most commonly associated with cloud-native architectures running many redundant, stateless instances, where losing any single one should be invisible to end users. The tool's narrow scope is also its limitation: it does not test network partitions, latency, or more nuanced distributed-systems failure modes, so organizations serious about chaos engineering today typically use it as a starting point or historical reference rather than a complete solution, graduating to broader platforms as their resilience testing matures and their coverage needs expand beyond simple instance loss.
Key Features
- Random termination of instances or containers on a schedule
- Business-hours-only execution so engineers are available to respond
- Originated the broader Simian Army family of resilience tools
- Open-source and configurable to target specific service groups
- Focused specifically on instance and container failure, not network faults
- Historically credited with popularizing the chaos engineering discipline