Per-exec cgroups follow-up: host-configured hard memory.max (no protobuf)

Adds an opt-in hard per-session memory ceiling on top of patch #9's scoped-OOM. The exec already ships the full OCI Spec, so the limit rides spec.linux.resources.memory.limit — no RPC/protobuf change: - host framework: LinuxProcessConfiguration.memoryLimitInBytes; LinuxContainer.exec stamps it onto the exec spec. - guest: Server+GRPC.createProcess reads it back and applies it as the exec cgroup's memory.max (new Cgroup2Manager.setMemoryMax) via createExec/ManagedProcess. - Nucleic: ContainerServiceSettings.controlPerSessionMemoryGiB (default 0 = off), applied only to the shared control container (ContainerManager.exec); wired through ContainerEngine.exec. So one session can't consume the whole shared container's memory before its own (oom.group-scoped) OOM. Default off preserves #9's behavior. Compile-verified host + musl guest; rides the pending -nucleic2 image, still runtime-pending. Co-Authored-By: Claude Opus 4.8 <[email protected]>
2026-07-13 20:12:42 -07:00
parent 2eb563c90c
commit 831d19c3a6
7 changed files with 53 additions and 8 deletions
@@ -388,6 +388,11 @@ public struct LinuxProcessConfiguration: Sendable {
    public var stdout: Writer?
    /// The stderr for the process.
    public var stderr: Writer?
+    /// [Nucleic vendored patch] A hard per-exec memory ceiling in bytes. When set, `LinuxContainer.exec`
+    /// stamps it onto the exec's `spec.linux.resources.memory.limit`, which the guest applies as
+    /// `memory.max` on this exec's own cgroup (see patch #9) — so one session can't consume the whole
+    /// shared container's memory before *its own* OOM. nil → no per-exec ceiling (inherit the container).
+    public var memoryLimitInBytes: UInt64?

    public init() {}