The automatic soft limit read only /sys/fs/cgroup/memory.max, the root of
the cgroup namespace. A systemd MemoryMax on x-ui.service lives below that
root, so it was never seen: on a bare host the root has no memory.max and
no soft limit was set at all, and inside an LXC/Incus container the limit
came from the container (2 GiB -> "1843 MiB") while systemd killed the
panel at 650M. Either way GC never tightened before the OOM kill.
Walk from the process's own cgroup (/proc/self/cgroup) up to the visible
root and take the tightest memory.max (cgroup v2) or
memory.limit_in_bytes (v1). Docker with a private cgroup namespace sees
the same root limit as before.
The Usage card showed runtime.MemStats.Sys, a never-shrinking high-water mark of reserved address space that also counts memory already returned to the OS, so it overstated real usage (e.g. ~300 MB on an idle 1-client server). Report process RSS instead so the number matches the OS and drops as memory is freed.
Replace the auto GOMEMLIMIT that targeted ~90 percent of total system RAM (a near no-op while the heap sits far below the limit, and a GC-thrash risk on small/shared VPS per go.dev/doc/gc-guide) with: a lower default GOGC (XUI_GOGC, default 75), a periodic debug.FreeOSMemory job (XUI_MEMORY_RELEASE_INTERVAL, default 10m, 0 disables), and a soft limit applied only from an explicit budget (GOMEMLIMIT, XUI_MEMORY_LIMIT, or a real cgroup cap at 90 percent).
cron: SkipIfStillRunning stops a slow 5s/10s job from overlapping itself and racing the shared xrayAPI (grpc conn leak) and the StatsLastValues map (fatal concurrent map write). memlimit: auto-detect a Go soft memory limit from XUI_MEMORY_LIMIT, the cgroup limit, or system RAM (about 90 percent); opt-in pprof via XUI_PPROF. tgbot: userStates now goes through a mutex-guarded store with TTL pruning (was raced by worker-pool and delayed-delete goroutines). check_client_ip: prefilter inbounds by settings LIKE limitIp instead of loading and JSON-parsing all of them every scan. minor: prune StatsLastValues, RateLimiter.lastSent, reportedRemoteTagConflict. docker-compose: document the memory knobs.
Aleksey Fedorov
MHSanaei