Skip to content

fix(installer): floor web-pdf at 1250MB (#2951) - #2956

Merged
osmontero merged 1 commit into
v11from
fix/webpdf-memory-floor
Oct 22, 2026
Merged

osmontero merged 1 commit into
v11from
fix/webpdf-memory-floor

Conversation

@osmontero

Copy link
Copy Markdown
Member

Fix the one real defect in #2951: web-pdf memory floor

#2951 is mostly a design proposal (fixed profiles vs the weighted split), but it exposed one concrete defect in the current code: web-pdf can be sized below what headless Chrome needs.

stack.go had web-pdf MinMemory: 1024. On a 16 GB host — the README minimum — the weighted BalanceMemory split assigned web-pdf only ~1,128 MB, below the ~1,250 MB threshold where Chromium OOMs in printPage. This is the same failure mode as #2934, where web-pdf OOM'd at ~1.1 GiB on a large report.

Change: web-pdf MinMemory 1024 → 1250.

Verification (simulated BalanceMemory verbatim):

  • 16 GB host: web-pdf 1128 → 1342 MB (now above the threshold); still fits all service minimums (total min 13,682 MB < 15,384 MB available after the 1 GB OS reserve).
  • 20 GB host: 1349 → 1563 MB.
  • Installer builds and go test ./... passes.

Not included (per the #2951 comment): the profile table, per-size OpenSearch heap, --invert, and recalc rollback. Those are design/feature changes with their own tradeoffs (the 16/32 GB profiles actually leave the OS less headroom than the current 1 GB reserve, and the 20 GB profile's OpenSearch is thin on off-heap), and I'd rather scope them separately once the approach is settled.

Related: #2951, #2934, #2918

web-pdf drives headless Chrome to render PDFs. Chromium OOMs in
printPage below ~1250MB. stack.go had web-pdf MinMemory at 1024, so on
a 16GB host (the README minimum) the weighted BalanceMemory split
assigned it only ~1128MB, below the working threshold. This is the
same failure mode as #2934 (web-pdf OOM'd at ~1.1GiB).

Raise MinMemory 1024 -> 1250. A 16GB host still fits all service
minimums (total min 13,682MB < 15,384MB available after the 1GB OS
reserve), and the weighted split then assigns web-pdf 1342MB there.
@osmontero
osmontero requested a review from a team October 22, 2026 09:49
@github-actions

Copy link
Copy Markdown

❌ Go dependencies check failed

There are outdated Go dependencies, or modules that could not be inspected.
Run bash .github/scripts/go-deps.sh --update --discover locally and
commit the updated go.mod / go.sum files.

Script output
🔍 Discovered 25 Go projects

📦 Dependencies with updates available:

  📁 ./agent:
     - github.com/netsampler/goflow2: v1.3.7 → v1.3.8
     - golang.org/x/sys: v0.48.0 → v0.49.0

  📁 ./installer:
     - github.com/cloudfoundry/gosigar: v1.3.127 → v1.3.128

  📁 ./plugins/azure:
     - github.com/Azure/azure-sdk-for-go/sdk/azcore: v1.23.1 → v1.23.3
     - github.com/Azure/azure-sdk-for-go/sdk/storage/azblob: v1.8.1 → v1.8.2

  📁 ./plugins/crowdstrike:
     - github.com/crowdstrike/gofalcon: v0.22.0 → v0.23.0

  📁 ./plugins/events:
     - github.com/tidwall/gjson: v1.19.0 → v1.20.0

  📁 ./plugins/geolocation:
     - github.com/tidwall/gjson: v1.19.0 → v1.20.0

  📁 ./plugins/aws:
     - github.com/aws/aws-sdk-go-v2: v1.47.0 → v1.47.3
     - github.com/aws/aws-sdk-go-v2/config: v1.33.5 → v1.33.9
     - github.com/aws/aws-sdk-go-v2/credentials: v1.20.5 → v1.20.9
     - github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs: v1.88.0 → v1.90.1

  📁 ./plugins/modules-config:
     - github.com/Azure/azure-sdk-for-go/sdk/storage/azblob: v1.8.1 → v1.8.2
     - github.com/aws/aws-sdk-go-v2/config: v1.33.5 → v1.33.9
     - github.com/aws/aws-sdk-go-v2/credentials: v1.20.5 → v1.20.9
     - github.com/aws/aws-sdk-go-v2/service/cloudwatchlogs: v1.88.0 → v1.90.1
     - github.com/aws/aws-sdk-go-v2/service/sts: v1.51.0 → v1.51.4
     - github.com/crowdstrike/gofalcon: v0.22.0 → v0.23.0
     - golang.org/x/sync: v0.23.0 → v0.24.0
     - google.golang.org/api: v0.299.0 → v0.307.0

  📁 ./plugins/alerts:
     - github.com/tidwall/gjson: v1.19.0 → v1.20.0

  📁 ./plugins/gcp:
     - google.golang.org/api: v0.299.0 → v0.307.0

�[0;31m❌ Please update dependencies before merging.�[0m

@github-actions

Copy link
Copy Markdown

🛑 AI review — Engineer review required

This PR touches critical paths or introduces changes the model cannot judge with sufficient confidence. @Kbayero @osmontero please review.

🛑 architecture (silas-1.7-pro) — blocking — must fix before merge

Summary: Installer default memory for web-pdf is raised from 1024 to 1250 MB, requiring deployment/resource review for supported hosts.

  • medium installer/docker/stack.go:81 — The installer changes a default stack memory floor. Confirm all supported host sizes still fit total service minimums and document rollback guidance if constrained deployments fail to start.

✅ bugs (silas-1.7-pro) — clean

Summary: No concrete bugs found in the diff.

No findings.

🛑 security (silas-1.7-pro) — blocking — must fix before merge

Summary: Installer memory allocation change only; no new vulnerabilities identified, but installer path requires human verification.

No findings.

@utmstackprapprover utmstackprapprover Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Changes requested — Go dependencies check failed (see above).

@osmontero
osmontero merged commit b1de408 into v11 Oct 22, 2026
5 of 7 checks passed
@osmontero
osmontero deleted the fix/webpdf-memory-floor branch October 22, 2026 09:52
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant