A method of maintaining availability on a distributed system, the method comprising: executing, by data processing hardware of the distributed system, a pool of primary virtual machine instances, each primary VM instance executing a corresponding individual service instance and comprising a rate of unavailability; determining, by the data processing hardware, a number of secondary VM instances required to maintain availability of the individual service instances when one or more of the primary VM instances are unavailable based on the number of primary VM instances in the pool of primary VM instances and the respective rate of unavailability and by calculating the following: VM secondary _ N = VM Primay _ Pool × SO MTTF, wherein VM secondary_N is the number of secondary VM instances, VM Primary_Pool is the number of primary VM instances, SO is highest expected length of time to re-create a primary VM instance among the primary VM instances, and MTTF is lowest mean-time-to-failure value among the primary VM instances; instantiating, by the data processing hardware, a pool of secondary VM instances based on the number of secondary VM instances required to maintain availability of the individual service instances; identifying, by the data processing hardware, unavailability of one of the primary VM instances in the pool of primary VM instances; and causing, by the data processing hardware, the unavailable primary VM instance to failover to one of the secondary VM instances in the pool of secondary VM instances to commence executing the individual service instance associated with the unavailable primary VM instance; after the failover to the secondary VM instance: determining, by the data processing hardware, that the secondary VM instance comprises a corresponding resource level that is less than a target resource level associated with the corresponding individual service instance; and during execution of the individual service instance by the secondary VM instance, growing, by the data processing hardware, the corresponding resource level of the secondary VM instance until the target resource level associated with the individual service instance is satisfied; wherein a number of secondary VM instances in the pool of secondary VM instances is less than the number of primary VM instances in the pool of primary VM instances. executing, by data processing hardware of the distributed system, a pool of primary virtual machine instances, each primary VM instance executing a corresponding individual service instance and comprising a rate of unavailability; determining, by the data processing hardware, a number of secondary VM instances required to maintain availability of the individual service instances when one or more of the primary VM instances are unavailable based on the number of primary VM instances in the pool of primary VM instances and the respective rate of unavailability and by calculating the following: VM secondary _ N = VM Primay _ Pool × SO MTTF, wherein VM secondary_N is the number of secondary VM instances, VM Primary_Pool is the number of primary VM instances, SO is highest expected length of time to re-create a primary VM instance among the primary VM instances, and MTTF is lowest mean-time-to-failure value among the primary VM instances; instantiating, by the data processing hardware, a pool of secondary VM instances based on the number of secondary VM instances required to maintain availability of the individual service instances; identifying, by the data processing hardware, unavailability of one of the primary VM instances in the pool of primary VM instances; and causing, by the data processing hardware, the unavailable primary VM instance to failover to one of the secondary VM instances in the pool of secondary VM instances to commence executing the individual service instance associated with the unavailable primary VM instance; after the failover to the secondary VM instance: determining, by the data processing hardware, that the secondary VM instance comprises a corresponding resource level that is less than a target resource level associated with the corresponding individual service instance; and during execution of the individual service instance by the secondary VM instance, growing, by the data processing hardware, the corresponding resource level of the secondary VM instance until the target resource level associated with the individual service instance is satisfied; wherein a number of secondary VM instances in the pool of secondary VM instances is less than the number of primary VM instances in the pool of primary VM instances. determining, by the data processing hardware, that the secondary VM instance comprises a corresponding resource level that is less than a target resource level associated with the corresponding individual service instance; and during execution of the individual service instance by the secondary VM instance, growing, by the data processing hardware, the corresponding resource level of the secondary VM instance until the target resource level associated with the individual service instance is satisfied; wherein a number of secondary VM instances in the pool of secondary VM instances is less than the number of primary VM instances in the pool of primary VM instances.