Repository navigation
Keep Kratos inside its memory limit under login bursts - #30
Merged
Merged
Conversation
Staging's e2e run OOM-killed Kratos (limit 256Mi) mid-run, failing every test after it. Each argon2 hash takes 64 MB (kratos.yml), and Go, not knowing the container limit, let the heap grow past it between collections. Production has the same limit; a burst of 20 logins, which the rate limiters allow, would have done the same there. - GOMEMLIMIT=400MiB makes the collector work before the limit, which rises to 512Mi. - limit-inflight: at most four password submissions reach Kratos at once (4 x 64 MB plus its baseline fit); the rest wait in Traefik. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
bulbashenko-com-deploy Bot
added a commit
to bulbashenko-com/infra
that referenced
this pull request
Oct 27, 2026
…bursts (bulbashenko-com/auth#30) 2 commit(s), 3 file(s) since 153f053: - d9d24d4 Merge pull request #30 from bulbashenko-com/kratos-memory - 9f682ac Keep Kratos inside its memory limit under login bursts Source: bulbashenko-com/auth@153f053...d9d24d4
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Находка staging, касается и prod. В staging e2e Kratos убило по OOM (лимит 256Mi) посреди прогона, и все тесты после этого упали. Каждый argon2-хэш занимает 64 МБ, а Go не знает о лимите контейнера и не убирает кучу вовремя. В prod тот же лимит: всплеск из 20 логинов, который пропускают rate-limit'ы, положил бы логин и там.
GOMEMLIMIT=400MiB, чтобы сборщик мусора срабатывал до лимита; лимит памяти поднят до 512Mi.limit-inflight(TraefikinFlightReq): одновременно до Kratos доходит не больше 4 отправок пароля (4 × 64 МБ плюс база влезают), остальные ждут в Traefik.🤖 Generated with Claude Code