RustProxy 0.24.7 transform resource-control audit

Scope

0.24.7 makes the transformation resource envelope configurable without changing transformation semantics. The global transform configuration now persists a UI resource preset, a process-wide temporary-memory ceiling, and a process-wide concurrent-transform ceiling. Existing configurations inherit the former 128 MiB memory behavior and a 32-attempt concurrency ceiling through serde defaults.

This workspace still has no Rust/Cargo toolchain, so compiler/type/runtime acceptance and sustained RSS profiling remain release-host gates.

Resource controls

Control	Default	Range	Behavior
`memory_budget_bytes`	128 MiB	1 MiB..2 GiB	Process-wide ceiling for estimated origin/decode/output buffers. It is not pre-allocated. If a new transform would exceed the current configured ceiling, the response fails open unchanged with `memory_pressure`.
`max_body_bytes`	2 MiB	1 KiB..32 MiB	Hard aggregation/decompression ceiling for one transformable response.
`max_inflight`	32	1..1024	Process-wide active transform-attempt ceiling. New work fails open unchanged with `concurrency_pressure` instead of waiting.

The memory limiter uses atomic byte reservations so a live configuration change takes effect for new attempts without resizing or replacing a semaphore. Existing reservations release their exact charge on drop.

Presets

Presets persist only administrator intent; numeric values are authoritative. They do not change enabled transform kinds or the extension allow-list.

Preset	Memory	Max body	Max concurrent
RAM saver	32 MiB	1 MiB	8
Recommended	128 MiB	2 MiB	32
Performance	512 MiB	8 MiB	64
Uber performance	1 GiB	32 MiB	128

Manual edits of any of the three resource fields clear the preset label to Custom. Settings stores the selected preset in the same revisioned SQLite configuration document and restores it after reopen.

Cache compatibility

Global transform representation/eligibility settings are now included in cache compatibility identity. Changing enabled transform kinds, extensions or max_body_bytes rotates the identity so cached representations cannot outlive a semantic policy change.

Resource-only fields (preset, memory_budget_bytes, max_inflight) are normalized out of the compatibility hash. Capacity tuning therefore does not purge HOT/COLD objects by itself.

UI safeguards

The Transform settings page exposes all three resource controls and four presets. It warns when the configured temporary-memory budget is smaller than the worst-case estimate for one maximum-size compressed response, and when the budget exceeds 50% of detected effective host/cgroup RAM. Warnings do not block an intentional expert configuration.

Runtime dashboard accounting

The same 0.24.7 release now exposes live resource accounting without changing any resource limit. GET /api/status reports a transform_resources view and a memory_accounting view. The Overview Process block shows process RSS, HOT cache RAM, cache transient RAM, the transform reservation/budget, active transform slots and the remaining non-cache RSS. The transform reservation is an intentionally conservative limiter charge, so it is shown as an overlapping diagnostic rather than added to RSS.

non_cache_rss_bytes is process RSS - accounted HOT/transient cache RAM with saturating subtraction. It therefore still includes transform buffers, connections, TLS, logging, Tokio/runtime state, allocator overhead and any other untracked process allocations. This is preferable to inventing per-subsystem heap precision that the allocator does not provide.

The cache runtime view now also exposes cold_limit_bytes and cold_limit_entries; the overview cache block shows current COLD disk bytes and objects against those limits. COLD is explicitly disk occupancy and is never added to process RAM.

The dedicated Transform dashboard also shows current process-wide reserved bytes versus memory_budget_bytes and active transform attempts versus max_inflight.

Regression coverage

transform settings validation and serde preset round-trip;
local atomic memory reservation obeys a runtime byte ceiling;
local atomic inflight reservation obeys a runtime concurrency ceiling;
SQLite close/reopen preserves transform preset, memory budget and concurrency limit;
cache identity ignores resource-only changes but rotates for transform representation/eligibility changes;
tools/checks/memory_contracts.py verifies the new dynamic memory/concurrency bounds without Rust;
source/release smoke checks verify the Transform UI, OpenAPI fields and release identity.
source/release smoke checks reject anyhow::Context on the boxed bounded-body collection error and require explicit anyhow::Error mapping.

Release-host acceptance gate

Run ./dev.sh fmt, ./dev.sh check and ./dev.sh test, then stress each preset with identity and compressed JS/CSS/HTML/SVG/JSON bodies. Acceptance target: RSS plateaus after warm-up, active transform work never exceeds the configured byte/concurrency ceilings, memory_pressure/concurrency_pressure appear only when expected, and cache contents remain valid after changing resource-only settings.

5.2 KiB Raw Blame History