mirror of
https://github.com/kevinveenbirkenbach/computer-playbook.git
synced 2026-11-06 10:59:59 +00:00
kevinveenbirkenbachandClaude Opus 5
fbeade7b47
The five DinD lab nodes run privileged with cgroupns=host, a writable host cgroupfs and seccomp/apparmor off, and carried no resource limit of any kind. A runaway node therefore competes with the Actions runner agent itself, and the platform reports that only as 'lost communication', never as an OOM. Only pids_limit for now. A memory cap needs a measured per-node peak, and every measurement available is a failure-time snapshot, i.e. a lower bound: 4.4 GiB on the busiest node of a variant-0 drill. Sizing the cap off that risks OOM-killing a legitimate container instead of the runaway node. The pid ceiling has no such problem: 8192 against a measured 981 is 8.3x. The value is a static default.env key on purpose. A handler-derived key is absent from .env on a fresh runner, and the topology export step runs before the install step that generates it, so compose interpolation would have failed every swarm job before anything deployed. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
88 lines
3.0 KiB
YAML
88 lines
3.0 KiB
YAML
x-node: &node
|
|
image: infinito-swarm-node
|
|
build:
|
|
context: .
|
|
args:
|
|
INFINITO_IMAGE: "${INFINITO_IMAGE:?run make dotenv / build the distro image first}"
|
|
privileged: true
|
|
cgroup: host
|
|
pids_limit: ${INFINITO_SWARM_NODE_PIDS_LIMIT:?run make dotenv first}
|
|
security_opt:
|
|
- seccomp=unconfined
|
|
- apparmor=unconfined
|
|
environment:
|
|
- DM_DISABLE_UDEV=1
|
|
tmpfs:
|
|
- /run
|
|
- /run/lock
|
|
labels:
|
|
- "${INFINITO_SWARM_TEST_LABEL:?run utils/topology/export.sh first}="
|
|
volumes:
|
|
- /sys/fs/cgroup:/sys/fs/cgroup:rw
|
|
- /lib/modules:/lib/modules:ro
|
|
extra_hosts:
|
|
- "${MGR:?run utils/topology/export.sh first}:${INFINITO_SWARM_MGR_IP:?run utils/topology/export.sh first}"
|
|
- "${WRK1:?run utils/topology/export.sh first}:${INFINITO_SWARM_WRK1_IP:?run utils/topology/export.sh first}"
|
|
- "${WRK2:?run utils/topology/export.sh first}:${INFINITO_SWARM_WRK2_IP:?run utils/topology/export.sh first}"
|
|
- "${NFS_SERVER:?run utils/topology/export.sh first}:${INFINITO_SWARM_NFS_IP:?run utils/topology/export.sh first}"
|
|
- "${BACKUP_NODE:?run utils/topology/export.sh first}:${INFINITO_SWARM_BACKUP_IP:?run utils/topology/export.sh first}"
|
|
|
|
services:
|
|
nfs-server:
|
|
<<: *node
|
|
container_name: "${NFS_SERVER:?run utils/topology/export.sh first}"
|
|
hostname: "${NFS_SERVER:?run utils/topology/export.sh first}"
|
|
volumes:
|
|
- /sys/fs/cgroup:/sys/fs/cgroup:rw
|
|
- /lib/modules:/lib/modules:ro
|
|
- "nfs-export:${NFS_EXPORT_BASE:?run utils/topology/export.sh first}"
|
|
networks:
|
|
lab:
|
|
ipv4_address: "${INFINITO_SWARM_NFS_IP:?run utils/topology/export.sh first}"
|
|
|
|
swarm-mgr-01:
|
|
<<: *node
|
|
container_name: "${MGR:?run utils/topology/export.sh first}"
|
|
hostname: "${MGR:?run utils/topology/export.sh first}"
|
|
networks:
|
|
lab:
|
|
ipv4_address: "${INFINITO_SWARM_MGR_IP:?run utils/topology/export.sh first}"
|
|
|
|
swarm-wrk-01:
|
|
<<: *node
|
|
container_name: "${WRK1:?run utils/topology/export.sh first}"
|
|
hostname: "${WRK1:?run utils/topology/export.sh first}"
|
|
networks:
|
|
lab:
|
|
ipv4_address: "${INFINITO_SWARM_WRK1_IP:?run utils/topology/export.sh first}"
|
|
|
|
swarm-wrk-02:
|
|
<<: *node
|
|
container_name: "${WRK2:?run utils/topology/export.sh first}"
|
|
hostname: "${WRK2:?run utils/topology/export.sh first}"
|
|
networks:
|
|
lab:
|
|
ipv4_address: "${INFINITO_SWARM_WRK2_IP:?run utils/topology/export.sh first}"
|
|
|
|
backup-host:
|
|
<<: *node
|
|
container_name: "${BACKUP_NODE:?run utils/topology/export.sh first}"
|
|
hostname: "${BACKUP_NODE:?run utils/topology/export.sh first}"
|
|
profiles: ["drill"]
|
|
networks:
|
|
lab:
|
|
ipv4_address: "${INFINITO_SWARM_BACKUP_IP:?run utils/topology/export.sh first}"
|
|
|
|
volumes:
|
|
nfs-export:
|
|
|
|
networks:
|
|
lab:
|
|
name: "${SWARM_LAB_NETWORK:?run utils/topology/export.sh first}"
|
|
driver: bridge
|
|
driver_opts:
|
|
com.docker.network.driver.mtu: "1400"
|
|
ipam:
|
|
config:
|
|
- subnet: "${INFINITO_SWARM_LAB_SUBNET:?run utils/topology/export.sh first}"
|