From 806024403ee6496dfff886d3ecdb53d4a2b646e6 Mon Sep 17 00:00:00 2001
From: Ruben Fiszel <ruben@windmill.dev>
Date: Fri, 19 Dec 2025 12:45:21 +0000
Subject: [PATCH] fix: disable oomgroup by default

---
 backend/src/cgroups.rs | 63 ++++++++++++++++++++++++++++++++++++++++++
 backend/src/main.rs    |  8 ++++++
 2 files changed, 71 insertions(+)
 create mode 100644 backend/src/cgroups.rs

diff --git a/backend/src/cgroups.rs b/backend/src/cgroups.rs
new file mode 100644
index 0000000000..b17955e585
--- /dev/null
+++ b/backend/src/cgroups.rs
@@ -0,0 +1,63 @@
+use std::fs;
+use std::path::PathBuf;
+
+#[derive(Debug)]
+pub enum CgroupError {
+    PathNotFound(PathBuf),
+    NotSupported,
+    PermissionDenied,
+    Io(std::io::Error),
+}
+
+impl From<std::io::Error> for CgroupError {
+    fn from(e: std::io::Error) -> Self {
+        CgroupError::Io(e)
+    }
+}
+
+pub fn get_cgroup_path() -> Result<PathBuf, CgroupError> {
+    let cgroup_info = fs::read_to_string("/proc/1/cgroup")?;
+
+    // Format: "0::/kubepods.slice/..." - we want the part after the second colon
+    let cgroup_rel = cgroup_info
+        .lines()
+        .next()
+        .and_then(|line| line.splitn(3, ':').nth(2))
+        .unwrap_or("")
+        .trim();
+
+    let cgroup_path = PathBuf::from(format!("/sys/fs/cgroup{}", cgroup_rel));
+
+    if !cgroup_path.is_dir() {
+        return Err(CgroupError::PathNotFound(cgroup_path));
+    }
+
+    Ok(cgroup_path)
+}
+
+pub fn disable_oom_group() -> Result<(), CgroupError> {
+    let cgroup_path = get_cgroup_path()?;
+    let oom_group_file = cgroup_path.join("memory.oom.group");
+
+    if !oom_group_file.exists() {
+        return Err(CgroupError::NotSupported);
+    }
+
+    let current = fs::read_to_string(&oom_group_file)?;
+    if current.trim() == "0" {
+        tracing::info!("memory.oom.group already disabled");
+        return Ok(());
+    }
+
+    match fs::write(&oom_group_file, "0") {
+        Ok(_) => {
+            tracing::info!("Disabled memory.oom.group at {:?}", cgroup_path);
+            Ok(())
+        }
+        Err(e) if e.kind() == std::io::ErrorKind::PermissionDenied => {
+            tracing::error!("Failed to disable memory.oom.group (need privileged mode)");
+            Err(CgroupError::PermissionDenied)
+        }
+        Err(e) => Err(CgroupError::Io(e)),
+    }
+}
diff --git a/backend/src/main.rs b/backend/src/main.rs
index f30d730e2d..c51d5f9da1 100644
--- a/backend/src/main.rs
+++ b/backend/src/main.rs
@@ -71,6 +71,8 @@ use windmill_common::worker::CLOUD_HOSTED;
 #[cfg(all(not(target_env = "msvc"), feature = "jemalloc"))]
 use monitor::monitor_mem;
 
+use crate::cgroups::disable_oom_group;
+
 #[cfg(all(not(target_env = "msvc"), feature = "jemalloc"))]
 use tikv_jemallocator::Jemalloc;
 
@@ -108,6 +110,7 @@ const DEFAULT_NUM_WORKERS: usize = 1;
 const DEFAULT_PORT: u16 = 8000;
 const DEFAULT_SERVER_BIND_ADDR: Ipv4Addr = Ipv4Addr::new(0, 0, 0, 0);
 
+mod cgroups;
 #[cfg(feature = "private")]
 pub mod ee;
 mod ee_oss;
@@ -507,6 +510,11 @@ async fn windmill_main() -> anyhow::Result<()> {
 
     let worker_mode = num_workers > 0;
 
+    if worker_mode {
+        if let Err(e) = disable_oom_group() {
+            tracing::warn!("failed to disable oom group: {:?}", e);
+        }
+    }
     let conn = if mode == Mode::Agent {
         conn
     } else {