fix: 精确回收 NC01 内存并修复 zombie 泄露

config/hwlab-node-control-plane.yaml

@@ -553,10 +553,11 @@ targets:
             - COPY --from=golang-toolchain /usr/local/go /usr/local/go
             - COPY --from=docker-cli /usr/bin/kubectl /usr/local/bin/kubectl
             - ENV PATH=/usr/local/go/bin:$PATH
+            - RUN apt-get update && apt-get install -y --no-install-recommends tini && rm -rf /var/lib/apt/lists/*
             - RUN ln -sf /usr/local/bin/bun /usr/local/bin/bunx
             - ENV HWLAB_CI_NODE_DEPS=/opt/hwlab-ci-node-deps/node_modules
             - RUN set -eu; export HTTP_PROXY="${HTTP_PROXY:-${http_proxy:-}}"; export HTTPS_PROXY="${HTTPS_PROXY:-${https_proxy:-$HTTP_PROXY}}"; export ALL_PROXY="${ALL_PROXY:-${all_proxy:-}}"; export NO_PROXY="${NO_PROXY:-${no_proxy:-}}"; export http_proxy="$HTTP_PROXY"; export https_proxy="$HTTPS_PROXY"; export all_proxy="$ALL_PROXY"; export no_proxy="$NO_PROXY"; export npm_config_registry="https://registry.npmmirror.com/"; export BUN_CONFIG_REGISTRY="https://registry.npmmirror.com/"; export npm_config_noproxy="$NO_PROXY"; if [ -n "$HTTP_PROXY" ]; then export npm_config_proxy="$HTTP_PROXY"; fi; if [ -n "$HTTPS_PROXY" ]; then export npm_config_https_proxy="$HTTPS_PROXY"; fi; export npm_config_fetch_retries=2; export npm_config_fetch_retry_mintimeout=2000; export npm_config_fetch_retry_maxtimeout=16000; export npm_config_fetch_timeout=120000; proxy_label="${HTTP_PROXY:+HTTP_PROXY}"; proxy_label="${proxy_label:-none}"; mkdir -p /opt/hwlab-ci-node-deps; cd /opt/hwlab-ci-node-deps; printf '{"private":true,"dependencies":{}}\n' > package.json; ok=0; delay=2; for attempt in 1 2 3 4 5; do echo "{\"event\":\"tools-yaml-node-npm-install\",\"attempt\":\"$attempt/5\",\"registry\":\"$npm_config_registry\",\"proxy\":\"$proxy_label\"}" >&2; if timeout 180s npm install --package-lock=false --no-save --ignore-scripts --no-audit --no-fund --omit=dev yaml@2.8.3; then ok=1; break; fi; if [ "$attempt" = 5 ]; then break; fi; echo "{\"event\":\"tools-yaml-node-npm-install\",\"status\":\"retrying\",\"attempt\":\"$attempt/5\",\"sleepSeconds\":$delay}" >&2; sleep "$delay"; delay=$((delay * 2)); done; test "$ok" = 1; node --input-type=module -e 'import("/opt/hwlab-ci-node-deps/node_modules/yaml/browser/dist/index.js").then((yaml)=>console.log("yaml-ok", typeof yaml.parse))'
-            - RUN node --version && npm --version && bun --version && git --version && python3 --version && docker --version && kubectl version --client=true && ssh -V && go version
+            - RUN node --version && npm --version && bun --version && git --version && python3 --version && docker --version && kubectl version --client=true && ssh -V && go version && tini --version
         buildArgs: {}
         buildNetwork: host
         publicBaseImages:
@@ -771,7 +772,8 @@ targets:
             - RUN ln -sf /usr/local/bin/bun /usr/local/bin/bunx
             - ENV HWLAB_CI_NODE_DEPS=/opt/hwlab-ci-node-deps/node_modules
             - RUN set -eu; export HTTP_PROXY="${HTTP_PROXY:-${http_proxy:-}}"; export HTTPS_PROXY="${HTTPS_PROXY:-${https_proxy:-$HTTP_PROXY}}"; export ALL_PROXY="${ALL_PROXY:-${all_proxy:-}}"; export NO_PROXY="${NO_PROXY:-${no_proxy:-}}"; export http_proxy="$HTTP_PROXY"; export https_proxy="$HTTPS_PROXY"; export all_proxy="$ALL_PROXY"; export no_proxy="$NO_PROXY"; export npm_config_registry="https://registry.npmmirror.com/"; export BUN_CONFIG_REGISTRY="https://registry.npmmirror.com/"; export npm_config_noproxy="$NO_PROXY"; if [ -n "$HTTP_PROXY" ]; then export npm_config_proxy="$HTTP_PROXY"; fi; if [ -n "$HTTPS_PROXY" ]; then export npm_config_https_proxy="$HTTPS_PROXY"; fi; export npm_config_fetch_retries=2; export npm_config_fetch_retry_mintimeout=2000; export npm_config_fetch_retry_maxtimeout=16000; export npm_config_fetch_timeout=120000; proxy_label="${HTTP_PROXY:+HTTP_PROXY}"; proxy_label="${proxy_label:-none}"; mkdir -p /opt/hwlab-ci-node-deps; cd /opt/hwlab-ci-node-deps; printf '{"private":true,"dependencies":{}}\n' > package.json; ok=0; delay=2; for attempt in 1 2 3 4 5; do echo "{\"event\":\"tools-yaml-node-npm-install\",\"attempt\":\"$attempt/5\",\"registry\":\"$npm_config_registry\",\"proxy\":\"$proxy_label\"}" >&2; if timeout 180s npm install --package-lock=false --no-save --ignore-scripts --no-audit --no-fund --omit=dev yaml@2.8.3; then ok=1; break; fi; if [ "$attempt" = 5 ]; then break; fi; echo "{\"event\":\"tools-yaml-node-npm-install\",\"status\":\"retrying\",\"attempt\":\"$attempt/5\",\"sleepSeconds\":$delay}" >&2; sleep "$delay"; delay=$((delay * 2)); done; test "$ok" = 1; node --input-type=module -e 'import("/opt/hwlab-ci-node-deps/node_modules/yaml/browser/dist/index.js").then((yaml)=>console.log("yaml-ok", typeof yaml.parse))'
-            - RUN node --version && npm --version && bun --version && git --version && python3 --version && docker --version && kubectl version --client=true && ssh -V && go version
+            - RUN apt-get update && apt-get install -y --no-install-recommends tini && rm -rf /var/lib/apt/lists/*
+            - RUN node --version && npm --version && bun --version && git --version && python3 --version && docker --version && kubectl version --client=true && ssh -V && go version && tini --version
         buildArgs: {}
         buildNetwork: host
         publicBaseImages:
@@ -991,7 +993,8 @@ targets:
             - RUN ln -sf /usr/local/bin/bun /usr/local/bin/bunx
             - ENV HWLAB_CI_NODE_DEPS=/opt/hwlab-ci-node-deps/node_modules
             - RUN set -eu; export HTTP_PROXY="${HTTP_PROXY:-${http_proxy:-}}"; export HTTPS_PROXY="${HTTPS_PROXY:-${https_proxy:-$HTTP_PROXY}}"; export ALL_PROXY="${ALL_PROXY:-${all_proxy:-}}"; export NO_PROXY="${NO_PROXY:-${no_proxy:-}}"; export http_proxy="$HTTP_PROXY"; export https_proxy="$HTTPS_PROXY"; export all_proxy="$ALL_PROXY"; export no_proxy="$NO_PROXY"; export npm_config_registry="https://registry.npmmirror.com/"; export BUN_CONFIG_REGISTRY="https://registry.npmmirror.com/"; export npm_config_noproxy="$NO_PROXY"; if [ -n "$HTTP_PROXY" ]; then export npm_config_proxy="$HTTP_PROXY"; fi; if [ -n "$HTTPS_PROXY" ]; then export npm_config_https_proxy="$HTTPS_PROXY"; fi; export npm_config_fetch_retries=2; export npm_config_fetch_retry_mintimeout=2000; export npm_config_fetch_retry_maxtimeout=16000; export npm_config_fetch_timeout=120000; proxy_label="${HTTP_PROXY:+HTTP_PROXY}"; proxy_label="${proxy_label:-none}"; mkdir -p /opt/hwlab-ci-node-deps; cd /opt/hwlab-ci-node-deps; printf '{"private":true,"dependencies":{}}\n' > package.json; ok=0; delay=2; for attempt in 1 2 3 4 5; do echo "{\"event\":\"tools-yaml-node-npm-install\",\"attempt\":\"$attempt/5\",\"registry\":\"$npm_config_registry\",\"proxy\":\"$proxy_label\"}" >&2; if timeout 180s npm install --package-lock=false --no-save --ignore-scripts --no-audit --no-fund --omit=dev yaml@2.8.3; then ok=1; break; fi; if [ "$attempt" = 5 ]; then break; fi; echo "{\"event\":\"tools-yaml-node-npm-install\",\"status\":\"retrying\",\"attempt\":\"$attempt/5\",\"sleepSeconds\":$delay}" >&2; sleep "$delay"; delay=$((delay * 2)); done; test "$ok" = 1; node --input-type=module -e 'import("/opt/hwlab-ci-node-deps/node_modules/yaml/browser/dist/index.js").then((yaml)=>console.log("yaml-ok", typeof yaml.parse))'
-            - RUN node --version && npm --version && bun --version && git --version && python3 --version && docker --version && kubectl version --client=true && ssh -V && go version
+            - RUN apt-get update && apt-get install -y --no-install-recommends tini && rm -rf /var/lib/apt/lists/*
+            - RUN node --version && npm --version && bun --version && git --version && python3 --version && docker --version && kubectl version --client=true && ssh -V && go version && tini --version
         buildArgs: {}
         buildNetwork: host
         publicBaseImages:
@@ -1252,7 +1255,8 @@ targets:
             - RUN ln -sf /usr/local/bin/bun /usr/local/bin/bunx
             - ENV HWLAB_CI_NODE_DEPS=/opt/hwlab-ci-node-deps/node_modules
             - RUN set -eu; unset HTTP_PROXY HTTPS_PROXY ALL_PROXY http_proxy https_proxy all_proxy; export npm_config_registry="https://registry.npmmirror.com/"; export BUN_CONFIG_REGISTRY="https://registry.npmmirror.com/"; export npm_config_fetch_retries=2; export npm_config_fetch_retry_mintimeout=2000; export npm_config_fetch_retry_maxtimeout=16000; export npm_config_fetch_timeout=120000; mkdir -p /opt/hwlab-ci-node-deps; cd /opt/hwlab-ci-node-deps; printf '{"private":true,"dependencies":{}}\n' > package.json; ok=0; delay=2; for attempt in 1 2 3 4 5; do echo "{\"event\":\"tools-yaml-node-npm-install\",\"attempt\":\"$attempt/5\",\"registry\":\"$npm_config_registry\",\"proxy\":\"none\"}" >&2; if timeout 180s npm install --package-lock=false --no-save --ignore-scripts --no-audit --no-fund --omit=dev yaml@2.8.3; then ok=1; break; fi; if [ "$attempt" = 5 ]; then break; fi; echo "{\"event\":\"tools-yaml-node-npm-install\",\"status\":\"retrying\",\"attempt\":\"$attempt/5\",\"sleepSeconds\":$delay}" >&2; sleep "$delay"; delay=$((delay * 2)); done; test "$ok" = 1; node --input-type=module -e 'import("/opt/hwlab-ci-node-deps/node_modules/yaml/browser/dist/index.js").then((yaml)=>console.log("yaml-ok", typeof yaml.parse))'
-            - RUN node --version && npm --version && bun --version && git --version && python3 --version && docker --version && kubectl version --client=true && ssh -V && go version
+            - RUN apt-get update && apt-get install -y --no-install-recommends tini && rm -rf /var/lib/apt/lists/*
+            - RUN node --version && npm --version && bun --version && git --version && python3 --version && docker --version && kubectl version --client=true && ssh -V && go version && tini --version
         buildArgs: {}
         buildNetwork: host
         publicBaseImages:

config/unidesk-cli.yaml

@@ -223,7 +223,7 @@ gc:
               minAgeHours: 336
               maxDeletePerRun: 5
         memoryPressure:
-          planPreviewLimit: 6
+          planPreviewLimit: 4
           processPatterns:
             - k3s-server
             - containerd
@@ -291,12 +291,86 @@ gc:
             targetMemAvailableBytes: 5368709120
             minimumSwapFreeBytesAfterReclaim: 34359738368
             targets:
-              - id: kubepods-inactive-anon
-                path: /sys/fs/cgroup/kubepods.slice
-                reclaimBytes: 3221225472
+              - id: kafka-broker-inactive-anon
+                workloadSelector:
+                  namespace: platform-infra
+                  matchLabels:
+                    strimzi.io/name: platform-infra-kafka-kafka
+                  maxMatchedPods: 1
+                reclaimBytes: 268435456
                 swappiness: 200
-                minimumInactiveAnonBytes: 3221225472
+                minimumInactiveAnonBytes: 268435456
                 priority: 10
+              - id: kafka-entity-operator-inactive-anon
+                workloadSelector:
+                  namespace: platform-infra
+                  matchLabels:
+                    strimzi.io/name: platform-infra-kafka-entity-operator
+                  maxMatchedPods: 1
+                reclaimBytes: 134217728
+                swappiness: 200
+                minimumInactiveAnonBytes: 134217728
+                priority: 20
+              - id: argocd-controller-inactive-anon
+                workloadSelector:
+                  namespace: argocd
+                  matchLabels:
+                    app.kubernetes.io/name: argocd-application-controller
+                  maxMatchedPods: 1
+                reclaimBytes: 134217728
+                swappiness: 200
+                minimumInactiveAnonBytes: 134217728
+                priority: 30
+              - id: gitea-inactive-anon
+                workloadSelector:
+                  namespace: devops-infra
+                  matchLabels:
+                    app.kubernetes.io/name: gitea
+                  maxMatchedPods: 1
+                reclaimBytes: 134217728
+                swappiness: 200
+                minimumInactiveAnonBytes: 134217728
+                priority: 40
+              - id: hwlab-v03-hwpod-worker-inactive-anon
+                workloadSelector:
+                  namespace: hwlab-v03
+                  matchLabels:
+                    app.kubernetes.io/name: hwlab-hwpod-worker
+                  maxMatchedPods: 2
+                reclaimBytes: 134217728
+                swappiness: 200
+                minimumInactiveAnonBytes: 134217728
+                priority: 50
+              - id: sub2rank-development-worker-inactive-anon
+                workloadSelector:
+                  namespace: platform-infra-development
+                  matchLabels:
+                    app.kubernetes.io/name: sub2rank-worker
+                  maxMatchedPods: 1
+                reclaimBytes: 134217728
+                swappiness: 200
+                minimumInactiveAnonBytes: 134217728
+                priority: 60
+              - id: hwlab-v03-harnessrl-worker-inactive-anon
+                workloadSelector:
+                  namespace: hwlab-v03
+                  matchLabels:
+                    app.kubernetes.io/name: hwlab-harnessrl-worker
+                  maxMatchedPods: 2
+                reclaimBytes: 134217728
+                swappiness: 200
+                minimumInactiveAnonBytes: 134217728
+                priority: 70
+              - id: hwlab-v03-workbench-worker-inactive-anon
+                workloadSelector:
+                  namespace: hwlab-v03
+                  matchLabels:
+                    app.kubernetes.io/name: hwlab-workbench-worker
+                  maxMatchedPods: 2
+                reclaimBytes: 134217728
+                swappiness: 200
+                minimumInactiveAnonBytes: 134217728
+                priority: 80
         kubernetesObjectRetention:
           enabled: true
           aggregatePreviewLimit: 1