fix(sysctl-tuner): raise the kernel keyring quota for rootless BuildKit #732

Merged

binjovi-bot merged 1 commit from fix/keyring-quota into trunk 2026-09-14 12:53:36 +00:00

Conversation 0 Commits 1 Files changed 2 +13

sean commented 2026-09-14 12:48:18 +00:00

Owner

Copy link

runc creates a session keyring per container and rootless BuildKit leaks them. After two days one node had its builder user at 200/200 keys (kernel.keys.maxkeys default) and every build on it failed to start with unable to create session key: disk quota exceeded (2026-09-14, rpg-lemonade PR #42, rpg-munchers v0.1.30 stage). The daemon was restarted once to clear it. The tuner now sets kernel.keys.maxkeys=20000 and kernel.keys.maxbytes=20000*20000 on every node.

Local: tests/host-arc-cap-contract.sh and tests/host-route-mtu-contract.sh pass; kubectl kustomize renders.

https://claude.ai/code/session_01HPdKaFBKQVs8hzfgXMrnwV

runc creates a session keyring per container and rootless BuildKit leaks them. After two days one node had its builder user at 200/200 keys (`kernel.keys.maxkeys` default) and every build on it failed to start with `unable to create session key: disk quota exceeded` (2026-09-14, rpg-lemonade PR #42, rpg-munchers v0.1.30 stage). The daemon was restarted once to clear it. The tuner now sets `kernel.keys.maxkeys=20000` and `kernel.keys.maxbytes=20000*20000` on every node. Local: `tests/host-arc-cap-contract.sh` and `tests/host-route-mtu-contract.sh` pass; `kubectl kustomize` renders. https://claude.ai/code/session_01HPdKaFBKQVs8hzfgXMrnwV

sean added 1 commit 2026-09-14 12:48:19 +00:00

fix(sysctl-tuner): raise the kernel keyring quota for rootless BuildKit ... 6f074b5a94

runc creates a session keyring per container, and the rootless BuildKit
daemon leaks them: after two days one node's builder user held 200 of
the default 200 keys and every build on that node failed to start
(`unable to create session key: disk quota exceeded`, 2026-09-14). A
daemon restart cleared it once. The tuner now sets kernel.keys.maxkeys
to 20000 and kernel.keys.maxbytes to 20000 x 20000 on every node, so the
leak stays harmless for months; the fork of BuildKit gets
--no-new-keyring separately. The ARC-cap contract forbids an eight-digit
literal, so the byte limit is a product.

Claude-Session: https://claude.ai/code/session_01HPdKaFBKQVs8hzfgXMrnwV

binjovi-bot merged commit 6f074b5a94 into trunk 2026-09-14 12:53:36 +00:00

binjovi-bot deleted branch fix/keyring-quota 2026-09-14 12:53:37 +00:00

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

sean/seanfarm!732

No description provided.