Commit `89eba6adea`

89eba6adea7aca334fa198418e227da374980c24

parent: 6bea6f3df8

Verified · cmc

cmc <hello@cleberg.net> · 2026-09-07 02:27 UTC

runner, deploy, wiki: -cpus and -memory cap a build's container

Unset means uncapped. bay1 runs -cpus 3 of 4 and no memory cap, since
the e2e suite needs most of the host's memory.

Ref #144

Layout: unified · split

.gitbay/wiki/Admin.org +4

 overrides it with =image:= in =.gitbay/ci.yml=, validated as a reference
 so a config file cannot turn it into podman arguments.
+=-cpus= and =-memory= cap one build's container (podman's own units,
+e.g. =-cpus 2 -memory 4g=); unset means uncapped. bay1 runs =-cpus 3=
+and no memory cap, since the e2e suite needs most of the host's 7GB.
 *Images are provisioned, never pulled by a build.* The runner passes
 =--pull=never=. Two reasons, and the second is the better one: the
 service runs with =RestrictSUIDSGID=yes= so podman cannot unpack a layer

cmd/gitbay-runner/env_test.go +13

	@@ -116,3 +116,16 @@ func TestEnvHomeFindsHome(t *testing.T) {
116	t.Errorf("envHome with no HOME = %q, want empty", got)	116	t.Errorf("envHome with no HOME = %q, want empty", got)
117	}	117	}
118	}	118	}
		119
		120	// A limit is passed to podman only when set; unset means uncapped, not a
		121	// default that could kill the suite.
		122	func TestLimitArgs(t *testing.T) {
		123	if got := (&runner{}).limitArgs(); len(got) != 0 {
		124	t.Errorf("no limits set, got %v", got)
		125	}
		126	got := (&runner{memory: "4g", cpus: "2"}).limitArgs()
		127	want := []string{"--memory", "4g", "--cpus", "2"}
		128	if strings.Join(got, " ") != strings.Join(want, " ") {
		129	t.Errorf("limitArgs = %v, want %v", got, want)
		130	}
		131	}

cmd/gitbay-runner/isolate.go +23 −4

 	name := fmt.Sprintf("gitbay-build-%d", j.ID)
 	// --rm so a container cannot outlive its build; the explicit rm below
 	// covers the case where the daemon-less run itself fails.
-	start := exec.Command(podman, append(r.podmanGlobal(), "run", "--detach", "--rm",
+	args := append(r.podmanGlobal(), "run", "--detach", "--rm", "--pull=never")
-		"--pull=never",
+	args = append(args, r.limitArgs()...)
+	args = append(args,
 		"--name", name,
 		"--env-file", envFile,
 		"--volume", dir+":/workspace:rw",
 		"--volume", envHome(env)+":"+envHome(env)+":rw",
 		"--workdir", "/workspace",
 		"--entrypoint", "sh",
-		image, "-c", "sleep infinity")...)
+		image, "-c", "sleep infinity")
+	start := exec.Command(podman, args...)
 	start.Env = []string{"PATH=" + os.Getenv("PATH"), "HOME=" + r.podmanHome()}
 	if out, err := start.CombinedOutput(); err != nil {
 		// A missing image lands here, and it is the common case worth
 	return []string{"--cgroup-manager=cgroupfs"}
 }
-// env_home returns the HOME the step environment carries.
+// limitArgs caps one build's container. The service's CPUWeight and
+// IOWeight shape the service against other services, not one build
+// against the host, and the threat model lists resource exhaustion as
+// unaddressed. Memory is deliberately uncapped by default: the e2e suite
+// peaks past 5GB on a 7GB host, and a cap that kills the suite is an
+// outage, not a limit.
+func (r *runner) limitArgs() []string {
+	var args []string
+	if r.memory != "" {
+		args = append(args, "--memory", r.memory)
+	}
+	if r.cpus != "" {
+		args = append(args, "--cpus", r.cpus)
+	}
+	return args
+}
+// envHome returns the HOME the step environment carries.
 func envHome(env []string) string {
 	for _, e := range env {
 		if strings.HasPrefix(e, "HOME=") {

cmd/gitbay-runner/main.go +7

 	// isolation selects how steps run: "podman" or "none".
 	image     string
 	isolation string
+	// memory and cpus cap one build's container; empty means no cap.
+	memory string
+	cpus   string
 	// repos limits which repositories this runner claims builds for. Empty
 	// means any, which is what a runner on the server itself wants; a runner
 	// somewhere that should not execute every repository's steps names them.
 		jobs      = flag.Int("jobs", 1, "builds to run at once")
 		image     = flag.String("image", "", "default container image for jobs that name none")
 		isolation = flag.String("isolation", "podman", "how steps run: podman, or none for no container")
+		memory    = flag.String("memory", "", "memory limit per build container, e.g. 4g (podman only; default unlimited)")
+		cpus      = flag.String("cpus", "", "CPU limit per build container, e.g. 2 (podman only; default unlimited)")
 		version   = flag.Bool("version", false, "print the commit this binary was built from, then exit")
 	)
 	flag.Parse()
 		timeout:   *timeout,
 		image:     *image,
 		isolation: *isolation,
+		memory:    *memory,
+		cpus:      *cpus,
 	}
 	if err := r.checkIsolation(); err != nil {
 		// Refusing to start is the point. A runner that quietly fell back

deploy/gitbay-runner.override.conf +5 −1

 # would otherwise make read-only. Prepare the host with
 # deploy/runner-podman-setup.sh before deploying a runner that isolates.
 [Service]
+# -cpus 3 of the host's 4 leaves a core for gitbayd and sshd while a build
+# runs. No -memory: the e2e suite peaks past 5GB of the 7GB, and a cap
+# that kills it is an outage rather than a limit (#144).
+#
 # ExecStart is overridden here rather than left in the unit so the flags
 # and the sandboxing that has to match them live in one file: -isolation
 # podman needs NoNewPrivileges=no below, and -image needs an image the
 # End it with the service.
 ExecStopPost=-/usr/bin/pkill -u ci-runner -x catatonit
 ExecStart=
-ExecStart=/usr/local/bin/gitbay-runner -remote git@127.0.0.1 -workdir /var/lib/gitbay-runner/work -poll 5s -timeout 45m -repos krz/gitbay -isolation podman -image localhost/gitbay-ci:1
+ExecStart=/usr/local/bin/gitbay-runner -remote git@127.0.0.1 -workdir /var/lib/gitbay-runner/work -poll 5s -timeout 45m -repos krz/gitbay -isolation podman -image localhost/gitbay-ci:1 -cpus 3
 Nice=10
 CPUWeight=30
 IOWeight=30

Commit 89eba6adea

Commit `89eba6adea`