From 961691d6d255735202aa20aa7da57d06fb535d57 Mon Sep 17 00:00:00 2001
From: Gabriel Radureau <arcodange@gmail.com>
Date: Fri, 24 Jul 2026 00:09:47 +0200
Subject: [PATCH] =?UTF-8?q?fix(cicd):=20cap=20act=5Frunner=20jobs=20(3g/2c?=
 =?UTF-8?q?pu/pids)=20and=20capacity=202=E2=86=921=20=E2=80=94=20a=20build?=
 =?UTF-8?q?=20can=20no=20longer=20take=20down=20pi1?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Incident 2026-07-23: an uncapped nuxt generate (3.5G RSS) on pi1 starved the
k3s control-plane and traefik (load >150, no swap, no OOM-kill) — every
*.arcodange.lab endpoint went dark, Gitea included, while Gitea itself was
healthy on pi2. Job containers are spawned via the host docker socket, so
cgroup caps on the job container are the only guardrail.

Applied live on pi1+pi3 via 03_cicd.yml on 2026-07-24 (both runners
re-registered; pi3's runner was down and is back in service).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 ansible/arcodange/factory/playbooks/03_cicd.yml | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/ansible/arcodange/factory/playbooks/03_cicd.yml b/ansible/arcodange/factory/playbooks/03_cicd.yml
index 6784be6..f274e65 100644
--- a/ansible/arcodange/factory/playbooks/03_cicd.yml
+++ b/ansible/arcodange/factory/playbooks/03_cicd.yml
@@ -64,7 +64,8 @@
                   # Where to store the registration result.
                   file: .runner
                   # Execute how many tasks concurrently at the same time.
-                  capacity: 2
+                  # 1 seul job à la fois : les hôtes (8 Go, control-plane k3s sur pi1) ne survivent pas à 2 builds lourds simultanés.
+                  capacity: 1
                   # Extra environment variables to run jobs.
                   envs:
                     A_TEST_ENV_NAME_1: a_test_env_value_1
@@ -117,7 +118,9 @@
                   # Whether to use privileged mode or not when launching task containers (privileged mode is required for Docker-in-Docker).
                   privileged: false
                   # And other options to be used when the container is started (eg, --add-host=my.gitea.url:host-gateway).
-                  options:
+                  # Plafonds durs : un build ne doit jamais pouvoir affamer l'hôte (incident 2026-07-23 :
+                  # nuxt generate à 3,5 Go RSS sur pi1 → load 150, ingress+API k3s morts → gitea.arcodange.lab injoignable).
+                  options: "--memory=3g --memory-swap=3g --cpus=2 --pids-limit=512"
                   # The parent directory of a job's working directory.
                   # NOTE: There is no need to add the first '/' of the path as act_runner will add it automatically. 
                   # If the path starts with '/', the '/' will be trimmed.