fix(memory): derive the Go soft limit from the panel's own cgroup (#7102)

The automatic soft limit read only /sys/fs/cgroup/memory.max, the root of
the cgroup namespace. A systemd MemoryMax on x-ui.service lives below that
root, so it was never seen: on a bare host the root has no memory.max and
no soft limit was set at all, and inside an LXC/Incus container the limit
came from the container (2 GiB -> "1843 MiB") while systemd killed the
panel at 650M. Either way GC never tightened before the OOM kill.

Walk from the process's own cgroup (/proc/self/cgroup) up to the visible
root and take the tightest memory.max (cgroup v2) or
memory.limit_in_bytes (v1). Docker with a private cgroup namespace sees
the same root limit as before.

internal/util/sys/memlimit.go

@@ -3,7 +3,9 @@ package sys
 import (
 	"fmt"
 	"os"
+	"path/filepath"
 	"runtime/debug"
+	"slices"
 	"strconv"
 	"strings"
 )
@@ -89,26 +91,51 @@ func MemoryReleaseIntervalMinutes() int {
 	return defaultReleaseMinutes
 }
 
-// cgroupMemoryLimit reads the container memory limit from cgroup v2 then v1.
+// cgroupMemoryLimit returns the tightest memory limit between this process's own
-// A "max" value or the v1 unlimited sentinel (~8 EiB) means no limit at this
+// cgroup and the cgroup root it can see: a systemd MemoryMax sits below that root.
-// level, so it reports not-found and the caller falls back to the Go default. The
-// files are absent off Linux, which also yields not-found.
 func cgroupMemoryLimit() (int64, bool) {
-	const unlimited = int64(1) << 62
+	self, _ := os.ReadFile("/proc/self/cgroup")
+	return cgroupMemoryLimitAt(string(self), "/sys/fs/cgroup")
+}
 
-	if b, err := os.ReadFile("/sys/fs/cgroup/memory.max"); err == nil {
+func cgroupMemoryLimitAt(selfCgroup, root string) (int64, bool) {
-		if s := strings.TrimSpace(string(b)); s != "" && s != "max" {
+	if limit, ok := tightestLimit(root, ownCgroupPath(selfCgroup, "0", ""), "memory.max"); ok {
-			if v, err := strconv.ParseInt(s, 10, 64); err == nil && v > 0 && v < unlimited {
+		return limit, true
-				return v, true
+	}
+	return tightestLimit(filepath.Join(root, "memory"), ownCgroupPath(selfCgroup, "", "memory"), "memory.limit_in_bytes")
+}
+
+// ownCgroupPath picks the /proc/self/cgroup line of the v2 hierarchy (id "0") or the
+// v1 hierarchy carrying controller; "/" when there is no such line.
+func ownCgroupPath(selfCgroup, id, controller string) string {
+	for line := range strings.Lines(selfCgroup) {
+		fields := strings.SplitN(strings.TrimSpace(line), ":", 3)
+		if len(fields) != 3 {
+			continue
+		}
+		if (id != "" && fields[0] == id && fields[1] == "") ||
+			(controller != "" && slices.Contains(strings.Split(fields[1], ","), controller)) {
+			return fields[2]
+		}
+	}
+	return "/"
+}
+
+// tightestLimit walks from root/rel up to root. "max" and the v1 unlimited
+// sentinel (~8 EiB) do not parse as a limit; files are absent off Linux.
+func tightestLimit(root, rel, name string) (int64, bool) {
+	const unlimited = int64(1) << 62
+	var limit int64
+	for dir := filepath.Join(root, filepath.Clean("/"+rel)); ; dir = filepath.Dir(dir) {
+		if b, err := os.ReadFile(filepath.Join(dir, name)); err == nil {
+			v, err := strconv.ParseInt(strings.TrimSpace(string(b)), 10, 64)
+			if err == nil && v > 0 && v < unlimited && (limit == 0 || v < limit) {
+				limit = v
 			}
 		}
-	}
+		if len(dir) <= len(root) {
-
+			break
-	if b, err := os.ReadFile("/sys/fs/cgroup/memory/memory.limit_in_bytes"); err == nil {
-		if v, err := strconv.ParseInt(strings.TrimSpace(string(b)), 10, 64); err == nil && v > 0 && v < unlimited {
-			return v, true
 		}
 	}
-
+	return limit, limit > 0
-	return 0, false
 }

internal/util/sys/memlimit_test.go

@@ -0,0 +1,91 @@
+package sys
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+func TestCgroupMemoryLimitAt(t *testing.T) {
+	const service = "/system.slice/x-ui.service"
+	tests := []struct {
+		name       string
+		selfCgroup string
+		files      map[string]string
+		want       int64
+		wantOK     bool
+	}{
+		{
+			name:       "systemd MemoryMax inside a container limit",
+			selfCgroup: "0::" + service + "\n",
+			files: map[string]string{
+				"root/memory.max":                "2147483648\n",
+				"root/system.slice/memory.max":   "max\n",
+				"root" + service + "/memory.max": "681574400\n",
+			},
+			want: 681574400, wantOK: true,
+		},
+		{
+			name:       "systemd MemoryMax on a bare host, root has no memory.max",
+			selfCgroup: "0::" + service + "\n",
+			files: map[string]string{
+				"root/system.slice/memory.max":   "max\n",
+				"root" + service + "/memory.max": "681574400\n",
+			},
+			want: 681574400, wantOK: true,
+		},
+		{
+			name:       "container limit tighter than the service limit",
+			selfCgroup: "0::" + service + "\n",
+			files: map[string]string{
+				"root/memory.max":                "536870912\n",
+				"root" + service + "/memory.max": "681574400\n",
+			},
+			want: 536870912, wantOK: true,
+		},
+		{
+			name:       "no limit at any level",
+			selfCgroup: "0::" + service + "\n",
+			files: map[string]string{
+				"root/memory.max":                "max\n",
+				"root" + service + "/memory.max": "max\n",
+			},
+		},
+		{
+			name:       "cgroup v1 limit on the service, unlimited sentinel at the root",
+			selfCgroup: "12:cpu,cpuacct:" + service + "\n7:memory:" + service + "\n",
+			files: map[string]string{
+				"root/memory/memory.limit_in_bytes":                "9223372036854771712\n",
+				"root/memory" + service + "/memory.limit_in_bytes": "681574400\n",
+			},
+			want: 681574400, wantOK: true,
+		},
+		{
+			name:       "cgroup outside the namespace never reads above the root",
+			selfCgroup: "0::/../../elsewhere\n",
+			files: map[string]string{
+				"memory.max":      "1048576\n",
+				"root/memory.max": "2147483648\n",
+			},
+			want: 2147483648, wantOK: true,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			dir := t.TempDir()
+			for name, body := range tt.files {
+				path := filepath.Join(dir, name)
+				if err := os.MkdirAll(filepath.Dir(path), 0o755); err != nil {
+					t.Fatal(err)
+				}
+				if err := os.WriteFile(path, []byte(body), 0o644); err != nil {
+					t.Fatal(err)
+				}
+			}
+			got, ok := cgroupMemoryLimitAt(tt.selfCgroup, filepath.Join(dir, "root"))
+			if got != tt.want || ok != tt.wantOK {
+				t.Fatalf("cgroupMemoryLimitAt() = %d, %v; want %d, %v", got, ok, tt.want, tt.wantOK)
+			}
+		})
+	}
+}