mirror of
https://github.com/CyberMind-FR/secubox-deb.git
synced 2026-07-29 13:59:40 +00:00
CyberMind-FR
b54f9c4e96
Captures the gk2 RAM optimization applied by hand on 2026-05-27.
Before: 117 MB free, 0 swap, no cgroup caps → 95+ packages thrashing.
After: 1.1 GB free, 4 GB swap, 12 LXC containers throttled at 2x current
RSS via cgroup MemoryHigh (soft cap = throttle, not OOM-kill).
Package contents:
sbin/secubox-tuning-apply idempotent CLI; reads two TOML
configs and applies swap + cgroup
caps. Supports --dry-run, swap-only,
cgroup-only.
etc/secubox/tuning/config.toml swap path + size (default 4G) +
minimum_data_free_gb safety.
etc/secubox/tuning/lxc-memory-high.toml
12 container → MemoryHigh mapping
(mail=500M, matrix=400M, etc.) from
gk2 baseline.
debian/postinst runs secubox-tuning-apply with safe
defaults.
debian/prerm deliberately preserves swap and
drop-ins on uninstall (manual
cleanup documented inline).
Cgroup caps applied two ways:
1. Direct write to /sys/fs/cgroup/lxc.payload.<name>/memory.high for
immediate runtime effect on running containers (no restart).
2. Edit of /data/lxc/<name>/config or /var/lib/lxc/<name>/config to
add lxc.cgroup2.memory.high = <cap>, so lxc-autostart re-applies
the cap on every container restart.
Initial attempt used systemd drop-ins under
/etc/systemd/system/lxc@<name>.service.d/ — turned out to be ineffective
on boards where containers are started by lxc-autostart (not by
systemctl start lxc@<name>.service). Refactored to the direct-cgroup +
LXC-config approach during gk2 verification.
Verified on gk2: all 12 containers show non-"max" memory.high in cgroup
+ matching lxc.cgroup2.memory.high in their LXC config files.
Distinct from secubox-hardening (kernel sysctl + AppArmor + module
blacklist for security) — this package is performance tuning.
|
||
|---|---|---|
| .. | ||
| debian | ||
| etc/secubox/tuning | ||
| sbin | ||