feat: cap controller container CPU, RAM, and PIDs#263
feat: cap controller container CPU, RAM, and PIDs#263konard wants to merge 3 commits intoProverCoderAI:mainfrom
Conversation
Adding .gitkeep for PR creation (default mode). This file will be removed when the task is complete. Issue: ProverCoderAI#260
Add cpus, mem_limit, memswap_limit, and pids_limit defaults to the docker-git-api controller in docker-compose.yml and docker-compose.api.yml. Each value is parameterized via a DOCKER_GIT_CONTROLLER_* env var so operators can tune them. Per-project containers already resolve a default 30% CPU/RAM cap through resolveComposeResourceLimits, but the privileged controller that orchestrates them had no caps and could consume the entire host. This closes that gap so the whole system's resource footprint stays bounded. Closes ProverCoderAI#260
konard
changed the title
Working session summaryPR is ready and out of draft. SummaryThe issue (Russian: "Make a limit on the consumption of the whole system's resources") was already partially addressed for per-project containers (default 30% CPU/RAM via PR #136). The remaining gap: the privileged Changes:
Verification: 6/6 new tests pass, 275/275 app tests pass, 166/166 lib tests pass, typecheck clean, lint:tests clean. PR: #263 This summary was automatically extracted from the AI working session output. |
🤖 Solution Draft LogThis log file contains the complete execution trace of the AI solution draft process. 💰 Cost: $4.840903📊 Context and tokens usage:Claude Opus 4.7:
Total: (114 new + 104.1K cache writes + 7.2M cache reads) input tokens, 20.6K output tokens, $4.743435 cost Claude Haiku 4.5:
Total: (61 new + 36.0K cache writes + 386.5K cache reads) input tokens, 2.8K output tokens, $0.097468 cost 🤖 Models used:
📎 Log file uploaded as Gist (2582KB)Now working session is ended, feel free to review and add any feedback on the solution draft. |
🔄 Auto-restart triggered (iteration 1)Reason: CI failures detected Starting new session to address the issues. Auto-restart-until-mergeable mode is active. This run will stop after 5 restart iterations. |
Replace node:fs/path/url imports and the as-const cast so the test passes the Effect-TS lint profile. Reads the compose files via FileSystem/Path services with a NodeContext layer instead of readFileSync + import.meta.url.
Working session summaryAll 15 CI checks pass (Build, Dist deps prune, all E2E suites, Lint, Lint Effect-TS, Snapshot, Test, Types). SummaryThe "Lint Effect-TS" CI check on PR #263 was failing because the new test file
Fix (commit PR: #263 This summary was automatically extracted from the AI working session output. |
🔄 Auto-restart-until-mergeable Log (iteration 1)This log file contains the complete execution trace of the AI solution draft process. 💰 Cost: $1.611414📊 Context and tokens usage:
Total: (56 new + 59.3K cache writes + 2.0M cache reads) input tokens, 9.0K output tokens, $1.611414 cost 🤖 Models used:
📎 Log file uploaded as Gist (3601KB)Now working session is ended, feel free to review and add any feedback on the solution draft. |
🔄 Auto-restart triggered (iteration 2)Reason: Uncommitted changes detected Starting new session to address the issues. Auto-restart-until-mergeable mode is active. This run will stop after 5 restart iterations. |
Working session summaryEverything is in order. Final state:
No further work needed; the PR is ready for review. This summary was automatically extracted from the AI working session output. |
🔄 Auto-restart-until-mergeable Log (iteration 2)This log file contains the complete execution trace of the AI solution draft process. 💰 Cost: $0.380035📊 Context and tokens usage:
Total: (16 new + 35.0K cache writes + 209.6K cache reads) input tokens, 2.2K output tokens, $0.380036 cost 🤖 Models used:
📎 Log file uploaded as Gist (3905KB)Now working session is ended, feel free to review and add any feedback on the solution draft. |
✅ Ready to mergeThis pull request is now ready to be merged:
Monitored by hive-mind with --auto-restart-until-mergeable flag |
1 participant
Summary
Per-project containers already inherit a default 30% CPU/RAM cap (via
resolveComposeResourceLimits), but the privilegeddocker-git-apicontroller that orchestrates them had no caps and could consume the entire host. This PR closes that gap so the whole system's resource footprint stays bounded.cpus,mem_limit,memswap_limit, andpids_limitdefaults to thedocker-git-apiservice indocker-compose.ymlanddocker-compose.api.yml.DOCKER_GIT_CONTROLLER_CPUS2.0DOCKER_GIT_CONTROLLER_MEMORY4gDOCKER_GIT_CONTROLLER_PIDS4096tests/docker-git/controller-resource-limits.test.tsso the controller compose files cannot regress to unbounded.Test plan
bun x vitest run tests/docker-git/controller-resource-limits.test.ts(6 passed)bun x vitest runinpackages/app(275 passed)bun x vitest runinpackages/lib(166 passed, after buildingdocker-git-session-sync)bun run typecheckinpackages/appbun run lint:testsinpackages/appNotes
mem_limit == memswap_limitdisables swap headroom so the container cannot leak past the RAM cap into swap..changeset/cap-controller-resources.md) is included so the next release picks up the change.Closes #260