Keep sudo outside the ulimit so the rlimit reaches the sensor #2
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Resource limit sensors | |
| on: | |
| push: | |
| branches: | |
| - main | |
| - 'claude/**' | |
| pull_request: | |
| workflow_dispatch: | |
| jobs: | |
| limits: | |
| # A GitHub-hosted Ubuntu runner is a full VM: systemd is PID 1 and the | |
| # unified cgroup hierarchy is mounted, so transient scopes really do apply | |
| # limits here. Both are asserted in the preflight step below. | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@v4 | |
| - uses: actions/setup-python@v5 | |
| with: | |
| python-version: '3.12' | |
| - name: Install dependencies | |
| run: pip install -r requirements-dev.txt | |
| - name: Preflight - the runner can impose the limits under test | |
| run: | | |
| set -euo pipefail | |
| echo "::group::versions" | |
| systemd-run --version | head -1 | |
| python --version | |
| nproc | |
| free -m | |
| echo "::endgroup::" | |
| filesystem="$(stat -fc %T /sys/fs/cgroup)" | |
| echo "cgroup filesystem: $filesystem" | |
| if [ "$filesystem" != "cgroup2fs" ]; then | |
| echo "::error::cgroup v2 is not mounted; the memory and CPU limits under test cannot be applied" | |
| exit 1 | |
| fi | |
| echo "controllers: $(cat /sys/fs/cgroup/cgroup.controllers)" | |
| # An unprivileged transient scope needs polkit, which cannot prompt | |
| # here, so the tests run systemd-run through sudo. Prove it works | |
| # before trusting any test result. | |
| sudo -n systemd-run --scope --quiet -p MemoryMax=64M -p MemorySwapMax=0 -- \ | |
| bash -c 'grep -H . /sys/fs/cgroup/$(cut -d: -f3 /proc/self/cgroup)/memory.max' | |
| - name: Report the limits for the examples from the request | |
| continue-on-error: true | |
| run: | | |
| # Informational: the exact shell forms the sensor has to understand. | |
| # Both must report 90 MiB, once from the cgroup and once from ulimit. | |
| PYTHON="$(which python)" | |
| for example in "102400 90M" "92160 100M"; do | |
| set -- $example | |
| echo "::group::(ulimit -v $1; systemd-run --scope -p MemoryMax=$2 -p MemorySwapMax=0 python3 tests/report_limits.py)" | |
| ( ulimit -v "$1" | |
| sudo -n systemd-run --scope --quiet -p "MemoryMax=$2" -p MemorySwapMax=0 -- \ | |
| "$PYTHON" tests/report_limits.py ) | python -m json.tool | |
| echo "::endgroup::" | |
| done | |
| - name: Run the resource limit tests | |
| env: | |
| # Never let "cannot impose limits here" turn into a silent skip. | |
| CGROUPS_SENSOR_REQUIRE_LIMITS: '1' | |
| run: python -m pytest -v |