Documentation
¶
Overview ¶
Package membudget is the process-wide admission controller for the bytes the api gateway commits to response-body buffering (issue #535). It is shared by every api connection and both buffering tools; the gateway aliases Budget as apigateway.MemBudget.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Budget ¶
type Budget struct {
// contains filtered or unexported fields
}
Budget is a process-wide admission controller for the bytes the api gateway commits to response-body buffering. It is the structural fix for issue #535: per-request size caps bound a single call, but nothing bounded the SUM of concurrent calls, so a burst of large responses (each individually under its cap) could collectively exhaust the heap and get the container OOMKilled (exit 137).
A single Budget is shared across every api connection and both buffering tools (api_invoke_endpoint and api_export). Before a tool allocates a body buffer it Reserves the worst-case byte count; the reservation is refused (Acquire returns false) when granting it would push committed bytes past the configured maximum. The caller then rejects the request before allocating, rather than allocating and risking OOM. Reservations are released when the buffer is no longer held.
The raw streaming passthrough (REST shim) deliberately does NOT reserve against this budget: it io.Copy's the upstream body through a small fixed buffer and never holds the whole body, so it is the memory-bounded escape hatch for legitimately large bodies.
A nil *Budget means "unlimited" — Acquire always succeeds and Release is a no-op. This keeps the budget optional: tests and deployments that do not configure a limit pass nil and pay nothing.
func New ¶
New returns a budget capping concurrently-committed body bytes at maxBytes. maxBytes <= 0 yields an unlimited (disabled) budget that is still safe to call — Acquire always succeeds.
func (*Budget) Acquire ¶
Acquire attempts to reserve n bytes. It returns true and commits the reservation when the budget can accommodate it, or false (committing nothing) when granting n would exceed the maximum. A nil budget, a disabled budget (max == 0), or a non-positive n always succeeds and commits nothing measurable — callers still pair such a call with Release(n), which is a no-op in those cases.
The check-and-commit is a lock-free compare-and-swap loop so that under a concurrent burst at most one caller can win the last slice of the budget; the rest observe the updated total and are refused.
func (*Budget) Enabled ¶
Enabled reports whether the budget enforces a ceiling. A nil or zero-max budget is disabled and admits every reservation.
func (*Budget) InUse ¶
InUse reports the bytes currently reserved. Zero on a nil or disabled budget. Intended for observability and tests.
func (*Budget) Max ¶
Max reports the configured ceiling, or 0 when the budget is nil or disabled (unlimited).
func (*Budget) Release ¶
Release returns n bytes to the budget. It is safe to call on a nil or disabled budget, and with n <= 0, in all of which cases it does nothing. Release must be paired with a prior Acquire(n) that returned true; releasing more than was acquired is clamped at zero so an accounting bug cannot drive inUse negative and silently widen the effective budget.
Source Files