[HIGH] Docker containers have no CPU or memory resource limits #20

New issue

Open

opened 2026-05-05 15:44:28 -05:00 by pjennings · 0 comments

pjennings commented

2026-05-05 15:44:28 -05:00

Owner

Labels: area:security, area:containers, priority:high, type:enhancement

Description

No container resource limits (CPU, memory) are configured for any OCI container in the infrastructure. A single runaway container could consume all host resources.

Impact

Denial of service for all other containers and host services
The ai1 host has already experienced OOM issues
A memory leak in any container affects the entire host

Recommended Fix

Add resource limits to all container definitions:

memory: Set based on service requirements (e.g., 2G for web apps, 4G for databases)
cpu-quota: Limit CPU usage to prevent single-container CPU saturation
Use NixOS oci-containers options or Docker Compose deploy.resources

**Labels:** area:security, area:containers, priority:high, type:enhancement ## Description No container resource limits (CPU, memory) are configured for any OCI container in the infrastructure. A single runaway container could consume all host resources. ## Impact - Denial of service for all other containers and host services - The ai1 host has already experienced OOM issues - A memory leak in any container affects the entire host ## Recommended Fix Add resource limits to all container definitions: - memory: Set based on service requirements (e.g., 2G for web apps, 4G for databases) - cpu-quota: Limit CPU usage to prevent single-container CPU saturation - Use NixOS oci-containers options or Docker Compose deploy.resources