nordisk/holger

server/lib/src/memory.rs

//! **The allocator's share of the server's memory** (lane HOL-RSS, 2026-11-01).
//!
//! glibc's malloc gives every thread that meets contention an arena of its own, up to
//! eight per core, and a freed block goes back to ITS arena, not to the system. The
//! server's threads are many (the reactor's workers, the blocking pool that reads every
//! artifact, the job runner), so a burst of downloads left each of them holding the
//! high-water mark of what it once read. MEASURED by holperf on oden (32 threads,
//! 2026-11-01, the real pip set): the live heap peaked at 535 MiB and the RSS at
//! 1760 MiB, and the RSS stayed at 1450 MiB with nothing live; with four arenas the
//! same run peaked at 598 MiB RSS for a 570 MiB heap. [`bound_allocator`] caps the
//! arenas, so what the process holds follows what it uses.
//!
//! The musl build (the appliance) has no arenas and no `mallopt`: there this is a no-op.

/// The arenas glibc may keep. Four, not one: one arena serialises every allocation of
/// every thread on its lock; four measured the same throughput as the default on oden.
pub const ARENA_MAX: i32 = 4;

/// Cap glibc's malloc arenas at [`ARENA_MAX`], unless the operator set
/// `MALLOC_ARENA_MAX` (glibc reads it itself, and it wins). Call it first in `main`,
/// before the runtime starts its threads. Returns the cap it set, `None` when it set
/// none (another libc, or the operator's own setting).
pub fn bound_allocator() -> Option<i32> {
    if std::env::var_os("MALLOC_ARENA_MAX").is_some() {
        return None;
    }
    set_arena_max(ARENA_MAX)
}

#[cfg(all(target_os = "linux", target_env = "gnu"))]
fn set_arena_max(n: i32) -> Option<i32> {
    // SAFETY: mallopt only sets a tunable of the allocator; any value is valid.
    (unsafe { libc::mallopt(libc::M_ARENA_MAX, n) } == 1).then_some(n)
}

#[cfg(not(all(target_os = "linux", target_env = "gnu")))]
fn set_arena_max(_: i32) -> Option<i32> {
    None
}

#[cfg(test)]
mod tests {
    use super::*;

    #[test]
    fn the_arenas_are_capped_on_glibc_and_left_alone_elsewhere() {
        let set = bound_allocator();
        if std::env::var_os("MALLOC_ARENA_MAX").is_some() {
            assert_eq!(set, None, "the operator's MALLOC_ARENA_MAX wins");
        } else if cfg!(all(target_os = "linux", target_env = "gnu")) {
            assert_eq!(set, Some(ARENA_MAX));
        } else {
            assert_eq!(set, None);
        }
    }
}