fix(memory): derive the Go soft limit from the panel's own cgroup (#7102)

The automatic soft limit read only /sys/fs/cgroup/memory.max, the root of
the cgroup namespace. A systemd MemoryMax on x-ui.service lives below that
root, so it was never seen: on a bare host the root has no memory.max and
no soft limit was set at all, and inside an LXC/Incus container the limit
came from the container (2 GiB -> "1843 MiB") while systemd killed the
panel at 650M. Either way GC never tightened before the OOM kill.

Walk from the process's own cgroup (/proc/self/cgroup) up to the visible
root and take the tightest memory.max (cgroup v2) or
memory.limit_in_bytes (v1). Docker with a private cgroup namespace sees
the same root limit as before.

internal/util/sys/memlimit.go

@@ -3,7 +3,9 @@ package sys
 import (
 	"fmt"
 	"os"
+	"path/filepath"
 	"runtime/debug"
+	"slices"
 	"strconv"
 	"strings"
 )
@@ -89,26 +91,51 @@ func MemoryReleaseIntervalMinutes() int {
 	return defaultReleaseMinutes
 }
 
-// cgroupMemoryLimit reads the container memory limit from cgroup v2 then v1.
-// A "max" value or the v1 unlimited sentinel (~8 EiB) means no limit at this
-// level, so it reports not-found and the caller falls back to the Go default. The
-// files are absent off Linux, which also yields not-found.
+// cgroupMemoryLimit returns the tightest memory limit between this process's own
+// cgroup and the cgroup root it can see: a systemd MemoryMax sits below that root.
 func cgroupMemoryLimit() (int64, bool) {
-	const unlimited = int64(1) << 62
+	self, _ := os.ReadFile("/proc/self/cgroup")
+	return cgroupMemoryLimitAt(string(self), "/sys/fs/cgroup")
+}
 
-	if b, err := os.ReadFile("/sys/fs/cgroup/memory.max"); err == nil {
-		if s := strings.TrimSpace(string(b)); s != "" && s != "max" {
-			if v, err := strconv.ParseInt(s, 10, 64); err == nil && v > 0 && v < unlimited {
-				return v, true
+func cgroupMemoryLimitAt(selfCgroup, root string) (int64, bool) {
+	if limit, ok := tightestLimit(root, ownCgroupPath(selfCgroup, "0", ""), "memory.max"); ok {
+		return limit, true
+	}
+	return tightestLimit(filepath.Join(root, "memory"), ownCgroupPath(selfCgroup, "", "memory"), "memory.limit_in_bytes")
+}
+
+// ownCgroupPath picks the /proc/self/cgroup line of the v2 hierarchy (id "0") or the
+// v1 hierarchy carrying controller; "/" when there is no such line.
+func ownCgroupPath(selfCgroup, id, controller string) string {
+	for line := range strings.Lines(selfCgroup) {
+		fields := strings.SplitN(strings.TrimSpace(line), ":", 3)
+		if len(fields) != 3 {
+			continue
+		}
+		if (id != "" && fields[0] == id && fields[1] == "") ||
+			(controller != "" && slices.Contains(strings.Split(fields[1], ","), controller)) {
+			return fields[2]
+		}
+	}
+	return "/"
+}
+
+// tightestLimit walks from root/rel up to root. "max" and the v1 unlimited
+// sentinel (~8 EiB) do not parse as a limit; files are absent off Linux.
+func tightestLimit(root, rel, name string) (int64, bool) {
+	const unlimited = int64(1) << 62
+	var limit int64
+	for dir := filepath.Join(root, filepath.Clean("/"+rel)); ; dir = filepath.Dir(dir) {
+		if b, err := os.ReadFile(filepath.Join(dir, name)); err == nil {
+			v, err := strconv.ParseInt(strings.TrimSpace(string(b)), 10, 64)
+			if err == nil && v > 0 && v < unlimited && (limit == 0 || v < limit) {
+				limit = v
 			}
 		}
-	}
-
-	if b, err := os.ReadFile("/sys/fs/cgroup/memory/memory.limit_in_bytes"); err == nil {
-		if v, err := strconv.ParseInt(strings.TrimSpace(string(b)), 10, 64); err == nil && v > 0 && v < unlimited {
-			return v, true
+		if len(dir) <= len(root) {
+			break
 		}
 	}
-
-	return 0, false
+	return limit, limit > 0
 }