Emil SimeonovandDevin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
cea84b1d89
The default systemd user service configuration (10-oomd-user-service-defaults.conf) sets ManagedOOMMemoryPressure=kill with ManagedOOMMemoryPressureLimit=50%. Under parallel DinD load (6 molecule tests), memory pressure exceeds 50% for 30 seconds, causing systemd-oomd to SIGKILL molecule containers (rc=137). This was the root cause of recurring "container is not running" and "Failed to create temporary directory" errors in CI. Fix: Create a per-user systemd override that sets: - ManagedOOMMemoryPressure=auto (don't kill on pressure) - ManagedOOMMemoryPressureLimit=100% (never trigger) - OOMScoreAdjust=-500 (very unlikely to be OOM-killed) The runner users run Docker-in-Docker workloads that legitimately use large amounts of memory. systemd-oomd's aggressive memory pressure killing is inappropriate for CI runner workloads. Generated with [Devin](https://devin.ai) Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>
100 lines
3.0 KiB
YAML
100 lines
3.0 KiB
YAML
---
|
|
- name: Create per-runner system user
|
|
ansible.builtin.user:
|
|
name: "{{ gitea_runner_service_user }}"
|
|
home: "{{ gitea_runner_home }}"
|
|
shell: /bin/bash
|
|
system: true
|
|
create_home: true
|
|
register: gitea_runner_user
|
|
|
|
- name: Set runner UID fact
|
|
ansible.builtin.set_fact:
|
|
gitea_runner_uid: "{{ gitea_runner_user.uid }}"
|
|
|
|
- name: Check if lingering is already enabled
|
|
ansible.builtin.stat:
|
|
path: "/var/lib/systemd/linger/{{ gitea_runner_service_user }}"
|
|
register: gitea_runner_linger_stat
|
|
|
|
- name: Enable lingering for runner user
|
|
ansible.builtin.command: loginctl enable-linger {{ gitea_runner_service_user }}
|
|
changed_when: not gitea_runner_linger_stat.stat.exists
|
|
when: gitea_runner_systemd_available.stat.exists
|
|
|
|
- name: Ensure subuid entry for runner user
|
|
ansible.builtin.lineinfile:
|
|
path: /etc/subuid
|
|
regexp: "^{{ gitea_runner_service_user }}:"
|
|
line: "{{ gitea_runner_service_user }}:100000:65536"
|
|
create: true
|
|
mode: "0644"
|
|
|
|
- name: Ensure subgid entry for runner user
|
|
ansible.builtin.lineinfile:
|
|
path: /etc/subgid
|
|
regexp: "^{{ gitea_runner_service_user }}:"
|
|
line: "{{ gitea_runner_service_user }}:100000:65536"
|
|
create: true
|
|
mode: "0644"
|
|
|
|
- name: Ensure XDG_RUNTIME_DIR exists
|
|
ansible.builtin.file:
|
|
path: "/run/user/{{ gitea_runner_uid }}"
|
|
state: directory
|
|
owner: "{{ gitea_runner_service_user }}"
|
|
group: "{{ gitea_runner_service_user }}"
|
|
mode: "0700"
|
|
|
|
- name: Ensure runner data directory exists
|
|
ansible.builtin.file:
|
|
path: "{{ gitea_runner_data_dir }}"
|
|
state: directory
|
|
owner: "{{ gitea_runner_service_user }}"
|
|
group: "{{ gitea_runner_service_user }}"
|
|
mode: "0755"
|
|
|
|
- name: Ensure runner config directory exists
|
|
ansible.builtin.file:
|
|
path: "{{ gitea_runner_config_dir }}"
|
|
state: directory
|
|
owner: "{{ gitea_runner_service_user }}"
|
|
group: "{{ gitea_runner_service_user }}"
|
|
mode: "0755"
|
|
|
|
- name: Ensure systemd user directory exists
|
|
ansible.builtin.file:
|
|
path: "{{ gitea_runner_home }}/.config/systemd/user"
|
|
state: directory
|
|
owner: "{{ gitea_runner_service_user }}"
|
|
group: "{{ gitea_runner_service_user }}"
|
|
mode: "0755"
|
|
|
|
- name: Disable systemd-oomd memory pressure kill for runner user
|
|
when: gitea_runner_systemd_available.stat.exists
|
|
block:
|
|
- name: Ensure user service override directory exists
|
|
ansible.builtin.file:
|
|
path: "/etc/systemd/system/user@{{ gitea_runner_uid }}.service.d"
|
|
state: directory
|
|
owner: root
|
|
group: root
|
|
mode: "0755"
|
|
|
|
- name: Disable ManagedOOMMemoryPressure for runner user
|
|
ansible.builtin.copy:
|
|
content: |
|
|
[Service]
|
|
ManagedOOMMemoryPressure=auto
|
|
ManagedOOMMemoryPressureLimit=100%
|
|
OOMScoreAdjust=-500
|
|
dest: "/etc/systemd/system/user@{{ gitea_runner_uid }}.service.d/oomd-override.conf"
|
|
owner: root
|
|
group: root
|
|
mode: "0644"
|
|
notify: Reload systemd user daemon
|
|
|
|
- name: Reload systemd daemon for oomd override
|
|
ansible.builtin.systemd:
|
|
daemon_reload: true
|