KNEL/cloudron
6
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: apply memory shrink + daemon.json — ground truth update [#731]

Browse Source 
11 apps reslidered via API (53.4->29.0GB explicit limits); daemon.json
live-restore + nofile defaults applied (log keys banned: unit flag
conflict — see #731 incident note). perf/apply-memory-shrink.sh codifies
the change. All 159 apps verified running.
Meat: https://projects.knownelement.com/issues/731#note-3929
This commit is contained in:
mrcharles
2026-09-02 19:48:45 -05:00
parent d9d512c9f1
commit 1267e60e8e
5 changed files with 76 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+17 -11
View File
@@ -11,7 +11,7 @@ Postgres/MySQL/mail containers, monitored by Uptime Kuma (Cloudron group).
| Path | What |
|------|------|
| `perf/` | [#685](https://projects.knownelement.com/issues/685) perf work: memory census, pg role-cap SQL, applied sysctl, planned docker daemon.json |
| `perf/` | [#685](https://projects.knownelement.com/issues/685) perf work: memory census, pg role-cap SQL, applied sysctl, applied `daemon.json`, `apply-memory-shrink.sh` |
| `monitoring/` | Uptime Kuma Cloudron app coverage — 55-app inventory + sync checker (moved from PFVCluster, #435/#685/#727) |
| `ansible/` | Reserved — AWX/Ansible IaC convergence ([#454](https://projects.knownelement.com/issues/454)); playbooks land here as manual changes are codified |
| `scripts/` | Rule engine + git hooks (enforcement layer, ADOPTING pattern) |
@@ -25,16 +25,22 @@ Postgres/MySQL/mail containers, monitored by Uptime Kuma (Cloudron group).
idle-in-transaction timeout 15min. Victim `too many clients` FATALs → zero.
- Host sysctl: `vm.swappiness=10` (`perf/sysctl/`). THP already `never`, virtio
scheduler `none` — optimal, left alone.
- **`/etc/docker/daemon.json` is still ABSENT on the host** (`live-restore=false`,
containers default to nofile=1024 unless bridged). The postgres fd bridge
(prlimit 262144) is EPHEMERAL — lost on any postgres container recreate.
Applying `perf/docker-daemon.json.planned` needs ONE planned dockerd bounce
(restarts all ~300 containers) in a human-chosen window.
- Memory sliders: shrink table on t/316 (~28GB headroom). Do NOT shrink
`bi.knownelement.com` or platform services (Cloudron auto-sizes those).
- **`/etc/docker/daemon.json` APPLIED 2026-09-02** (#731): `live-restore: true`
(future dockerd restarts are zero-downtime) + `default-ulimits nofile
262144` (every container start gets real fd limits — the postgres prlimit
bridge is no longer needed; `perf/docker-daemon.json` is the SoR copy).
NOTE: this host's dockerd runs `--log-driver=journald` as a unit flag —
daemon.json must NOT set log-driver/log-opts or dockerd refuses to start
(bit us once, see #731). Container log rotation is journald's job here.
- **Memory shrink table APPLIED 2026-09-02** (#731) via the panel API
(`perf/apply-memory-shrink.sh`): 11 apps resliders, explicit limits
53.4 GB → 29.0 GB (~24 GB of the ~28 GB headroom reclaimed). Skips:
photos (manifest floor 3.5 GB), `bi.knownelement.com` + platform services
(do NOT shrink). All 159 apps verified running post-change.
## Access
SSH `root@my.knownelement.com` is the only access path — routed through the
KNEL/PFVCluster `tests/remote.sh` chokepoint (see AGENTS.md). Cloudron API
token pending; once issued, refs live in `~/.creds/cloudron.env`, never here.
SSH `root@my.knownelement.com` — routed through the KNEL/PFVCluster
`tests/remote.sh` chokepoint (see AGENTS.md). Panel API token issued
2026-09-02 (`~/.creds/cloudron.env`, refs only in this repo) — prefer the
API over SSH for reads/limits; base image rebuilds (#710) still need SSH.