From efe768521d45c5a26d284b6c75a512b2e257efac Mon Sep 17 00:00:00 2001 From: Aleksey Fedorov <320380254+Dv2Corn@users.noreply.github.com> Date: Fri, 13 Nov 2026 08:35:08 +1000 Subject: [PATCH] fix(memory): derive the Go soft limit from the panel's own cgroup (#7102) The automatic soft limit read only /sys/fs/cgroup/memory.max, the root of the cgroup namespace. A systemd MemoryMax on x-ui.service lives below that root, so it was never seen: on a bare host the root has no memory.max and no soft limit was set at all, and inside an LXC/Incus container the limit came from the container (2 GiB -> "1843 MiB") while systemd killed the panel at 650M. Either way GC never tightened before the OOM kill. Walk from the process's own cgroup (/proc/self/cgroup) up to the visible root and take the tightest memory.max (cgroup v2) or memory.limit_in_bytes (v1). Docker with a private cgroup namespace sees the same root limit as before. --- internal/util/sys/memlimit.go | 59 +++++++++++++------ internal/util/sys/memlimit_test.go | 91 ++++++++++++++++++++++++++++++ 2 files changed, 134 insertions(+), 16 deletions(-) create mode 100644 internal/util/sys/memlimit_test.go diff --git a/internal/util/sys/memlimit.go b/internal/util/sys/memlimit.go index ca6836308..b3a7467ee 100644 --- a/internal/util/sys/memlimit.go +++ b/internal/util/sys/memlimit.go @@ -3,7 +3,9 @@ package sys import ( "fmt" "os" + "path/filepath" "runtime/debug" + "slices" "strconv" "strings" ) @@ -89,26 +91,51 @@ func MemoryReleaseIntervalMinutes() int { return defaultReleaseMinutes } -// cgroupMemoryLimit reads the container memory limit from cgroup v2 then v1. -// A "max" value or the v1 unlimited sentinel (~8 EiB) means no limit at this -// level, so it reports not-found and the caller falls back to the Go default. The -// files are absent off Linux, which also yields not-found. +// cgroupMemoryLimit returns the tightest memory limit between this process's own +// cgroup and the cgroup root it can see: a systemd MemoryMax sits below that root. func cgroupMemoryLimit() (int64, bool) { - const unlimited = int64(1) << 62 + self, _ := os.ReadFile("/proc/self/cgroup") + return cgroupMemoryLimitAt(string(self), "/sys/fs/cgroup") +} - if b, err := os.ReadFile("/sys/fs/cgroup/memory.max"); err == nil { - if s := strings.TrimSpace(string(b)); s != "" && s != "max" { - if v, err := strconv.ParseInt(s, 10, 64); err == nil && v > 0 && v < unlimited { - return v, true +func cgroupMemoryLimitAt(selfCgroup, root string) (int64, bool) { + if limit, ok := tightestLimit(root, ownCgroupPath(selfCgroup, "0", ""), "memory.max"); ok { + return limit, true + } + return tightestLimit(filepath.Join(root, "memory"), ownCgroupPath(selfCgroup, "", "memory"), "memory.limit_in_bytes") +} + +// ownCgroupPath picks the /proc/self/cgroup line of the v2 hierarchy (id "0") or the +// v1 hierarchy carrying controller; "/" when there is no such line. +func ownCgroupPath(selfCgroup, id, controller string) string { + for line := range strings.Lines(selfCgroup) { + fields := strings.SplitN(strings.TrimSpace(line), ":", 3) + if len(fields) != 3 { + continue + } + if (id != "" && fields[0] == id && fields[1] == "") || + (controller != "" && slices.Contains(strings.Split(fields[1], ","), controller)) { + return fields[2] + } + } + return "/" +} + +// tightestLimit walks from root/rel up to root. "max" and the v1 unlimited +// sentinel (~8 EiB) do not parse as a limit; files are absent off Linux. +func tightestLimit(root, rel, name string) (int64, bool) { + const unlimited = int64(1) << 62 + var limit int64 + for dir := filepath.Join(root, filepath.Clean("/"+rel)); ; dir = filepath.Dir(dir) { + if b, err := os.ReadFile(filepath.Join(dir, name)); err == nil { + v, err := strconv.ParseInt(strings.TrimSpace(string(b)), 10, 64) + if err == nil && v > 0 && v < unlimited && (limit == 0 || v < limit) { + limit = v } } - } - - if b, err := os.ReadFile("/sys/fs/cgroup/memory/memory.limit_in_bytes"); err == nil { - if v, err := strconv.ParseInt(strings.TrimSpace(string(b)), 10, 64); err == nil && v > 0 && v < unlimited { - return v, true + if len(dir) <= len(root) { + break } } - - return 0, false + return limit, limit > 0 } diff --git a/internal/util/sys/memlimit_test.go b/internal/util/sys/memlimit_test.go new file mode 100644 index 000000000..32e37e92c --- /dev/null +++ b/internal/util/sys/memlimit_test.go @@ -0,0 +1,91 @@ +package sys + +import ( + "os" + "path/filepath" + "testing" +) + +func TestCgroupMemoryLimitAt(t *testing.T) { + const service = "/system.slice/x-ui.service" + tests := []struct { + name string + selfCgroup string + files map[string]string + want int64 + wantOK bool + }{ + { + name: "systemd MemoryMax inside a container limit", + selfCgroup: "0::" + service + "\n", + files: map[string]string{ + "root/memory.max": "2147483648\n", + "root/system.slice/memory.max": "max\n", + "root" + service + "/memory.max": "681574400\n", + }, + want: 681574400, wantOK: true, + }, + { + name: "systemd MemoryMax on a bare host, root has no memory.max", + selfCgroup: "0::" + service + "\n", + files: map[string]string{ + "root/system.slice/memory.max": "max\n", + "root" + service + "/memory.max": "681574400\n", + }, + want: 681574400, wantOK: true, + }, + { + name: "container limit tighter than the service limit", + selfCgroup: "0::" + service + "\n", + files: map[string]string{ + "root/memory.max": "536870912\n", + "root" + service + "/memory.max": "681574400\n", + }, + want: 536870912, wantOK: true, + }, + { + name: "no limit at any level", + selfCgroup: "0::" + service + "\n", + files: map[string]string{ + "root/memory.max": "max\n", + "root" + service + "/memory.max": "max\n", + }, + }, + { + name: "cgroup v1 limit on the service, unlimited sentinel at the root", + selfCgroup: "12:cpu,cpuacct:" + service + "\n7:memory:" + service + "\n", + files: map[string]string{ + "root/memory/memory.limit_in_bytes": "9223372036854771712\n", + "root/memory" + service + "/memory.limit_in_bytes": "681574400\n", + }, + want: 681574400, wantOK: true, + }, + { + name: "cgroup outside the namespace never reads above the root", + selfCgroup: "0::/../../elsewhere\n", + files: map[string]string{ + "memory.max": "1048576\n", + "root/memory.max": "2147483648\n", + }, + want: 2147483648, wantOK: true, + }, + } + for _, tt := range tests { + t.Run(tt.name, func(t *testing.T) { + dir := t.TempDir() + for name, body := range tt.files { + path := filepath.Join(dir, name) + if err := os.MkdirAll(filepath.Dir(path), 0o755); err != nil { + t.Fatal(err) + } + if err := os.WriteFile(path, []byte(body), 0o644); err != nil { + t.Fatal(err) + } + } + got, ok := cgroupMemoryLimitAt(tt.selfCgroup, filepath.Join(dir, "root")) + if got != tt.want || ok != tt.wantOK { + t.Fatalf("cgroupMemoryLimitAt() = %d, %v; want %d, %v", got, ok, tt.want, tt.wantOK) + } + }) + } +}