Files
felhom.eu/documentation/audits/night-2026-10-28/tools/r528_live.py
T

36 lines
2.5 KiB
Python

#!/usr/bin/env python3
"""r528_live.py deploy|squeeze|teardown — R-528 live proof on Tester 1 (night 2026-10-28): a throwaway Radicale (its
catalog limit, 128M) gets a memory hog run inside it (`tail /dev/zero`, a child process); the kernel kills the hog, the
container keeps running. Want: the host counter rises, the controller's 30-s scan logs the OOM line once with the app's
name and the source, and pushes app_oom."""
import json, os, sys, time
sys.path.insert(0, "/mnt/5_hdd/felhom.eu/git/app-catalog-felhom.eu/scripts")
os.environ["SC"] = "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/0b76c4d7-9b39-4e4e-869d-d0d2c6006331/scratchpad/rt-tester1"
os.environ["TARGET"] = "tester-1"
import box_walk as w
EV = "/tmp/claude-1000/-mnt-5-hdd-felhom-eu-git/0b76c4d7-9b39-4e4e-869d-d0d2c6006331/scratchpad/night/p3"
APP = "radicale"
w.login()
if sys.argv[1] == "deploy":
ok = w.deploy(APP, "radicale")
w.say(f"deploy ok={ok}")
w.say(w.guest("docker ps --filter name=radicale --format '{{.Names}} {{.ID}} {{.Status}}'; docker inspect -f '{{.Id}} {{.HostConfig.Memory}} {{.State.OOMKilled}} {{.State.StartedAt}}' radicale"))
elif sys.argv[1] == "squeeze":
cid = w.guest("docker inspect -f '{{.Id}}' radicale").strip()
w.say(f"container id {cid}")
hostf = f"/sys/fs/cgroup/lxc/9201/ns/system.slice/docker-{cid}.scope/memory.events"
w.say("host counter before: " + w.sh(w.ssh_args() + ["root@192.168.0.154", f"grep oom_kill {hostf}"]).stdout.strip())
t0 = time.strftime("%Y-%m-%dT%H:%M:%SZ", time.gmtime())
w.say("hog: " + w.guest("docker exec radicale sh -c 'tail /dev/zero' ; echo rc=$?", timeout=300).strip())
w.say("after the hog: " + w.guest("docker inspect -f 'running={{.State.Running}} oomkilled={{.State.OOMKilled}} restarts={{.RestartCount}} started={{.State.StartedAt}}' radicale"))
w.say("host counter after: " + w.sh(w.ssh_args() + ["root@192.168.0.154", f"grep oom_kill {hostf}"]).stdout.strip())
time.sleep(75) # two 30-s scans
w.say("controller lines: " + w.guest(f"docker logs --since {t0} felhom-controller 2>&1 | grep -E 'OOM|oom|app_oom|R-528' | head -20"))
w.say("second scan window, again (must not repeat the event): ")
time.sleep(65)
w.say(w.guest(f"docker logs --since {t0} felhom-controller 2>&1 | grep -cE 'event.*app_oom|app_oom.*(sent|pushed|queued)'"))
w.say(w.guest(f"docker logs --since {t0} felhom-controller 2>&1 | grep -E 'app_oom' | head -10"))
elif sys.argv[1] == "teardown":
w.remove(APP)
open(os.path.join(EV, f"r528-{sys.argv[1]}.log"), "a").write("\n".join(w.LOG) + "\n")