From 677729c4b866c3914f62214d611e6d4a7fd75641 Mon Sep 17 00:00:00 2001
From: Prasanth Baskar <prasanth@8gears.com>
Date: Wed, 12 Aug 2026 13:41:58 +0530
Subject: [PATCH] feat: zram, systemd-oomd, and user-slice memory caps

Builds (cargo/webpack/tsc/link steps) can balloon memory on this
laptop's 8GiB and, with no swap and no OOM intervention, thrash the
kernel until it hard-hangs and needs a force reboot. Same class of
problem #15 already fixed for the bootc build itself, applied here to
the running desktop:

- zram-generator: compressed RAM swap (up to 8GiB, zstd) absorbs
  spikes instead of the kernel having nowhere to reclaim to.
- systemd-oomd: enabled with SwapUsedLimit=90%, watches memory
  pressure (PSI) and kills the worst offending cgroup before the
  whole system grinds to a halt.
- user-.slice MemoryHigh=85% / MemoryMax=92%: caps everything the
  user session runs (builds, browser, terminal) at 85% of RAM,
  always reserving headroom for system.slice and the kernel.

Verified live via usr-overlay + matching /etc drop-ins before landing
here: zram0 came up as 7.4G zstd swap, systemd-oomd.socket enabled and
listening, and the slice cap applied and reads back correctly via
systemctl show.

Signed-off-by: Prasanth Baskar <prasanth@8gears.com>
---
 Containerfile.pc | 31 +++++++++++++++++++++++++++++++
 1 file changed, 31 insertions(+)

diff --git a/Containerfile.pc b/Containerfile.pc
index 5dcdb63..64dc5f6 100644
--- a/Containerfile.pc
+++ b/Containerfile.pc
@@ -111,6 +111,7 @@ RUN --mount=type=tmpfs,dst=/tmp --mount=type=cache,dst=/usr/lib/sysimage/cache/p
     pamixer \
     matugen \
     power-profiles-daemon \
+    zram-generator \
     sudo \
     wireplumber \
     xdg-utils \
@@ -210,6 +211,35 @@ RUN install -d /usr/lib/systemd/logind.conf.d && \
         'HandleLidSwitchExternalPower=ignore' \
         > /usr/lib/systemd/logind.conf.d/10-lid-ignore.conf
 
+# Builds (cargo/webpack/tsc/link steps) can balloon memory on this laptop's
+# 8GiB and, with no swap and no OOM intervention, thrash the kernel until it
+# hard-hangs. Three layers of defense:
+#   1. zram: compressed RAM swap absorbs spikes instead of the kernel having
+#      nowhere to reclaim to.
+#   2. systemd-oomd: watches memory pressure (PSI) and kills the worst
+#      offending cgroup before the whole system grinds to a halt.
+#   3. user-.slice MemoryHigh/MemoryMax: caps everything the user session runs
+#      (builds, browser, terminal) at 85% of RAM, always reserving headroom
+#      for system.slice and the kernel.
+RUN install -d /usr/lib/systemd/oomd.conf.d /usr/lib/systemd/system/user-.slice.d && \
+    printf '%s\n' \
+        '[zram0]' \
+        'zram-size = min(ram, 8192)' \
+        'compression-algorithm = zstd' \
+        'swap-priority = 100' \
+        > /usr/lib/systemd/zram-generator.conf && \
+    printf '%s\n' \
+        '[OOM]' \
+        'SwapUsedLimit=90%' \
+        > /usr/lib/systemd/oomd.conf.d/10-swap-limit.conf && \
+    printf '%s\n' \
+        '[Slice]' \
+        'MemoryHigh=85%' \
+        'MemoryMax=92%' \
+        'ManagedOOMMemoryPressure=kill' \
+        'ManagedOOMMemoryPressureLimit=50%' \
+        > /usr/lib/systemd/system/user-.slice.d/10-resource-limits.conf
+
 # Keep the initramfs aligned with the final kernel, firmware, microcode, and
 # NVIDIA modules by running the same generic builder as the Bootcrew-style
 # base after the desktop package transaction.
@@ -239,6 +269,7 @@ RUN systemctl enable \
     gdm \
     systemd-resolved \
     systemd-timesyncd \
+    systemd-oomd.socket \
     fstrim.timer
 
 RUN ln -sf /usr/share/zoneinfo/Asia/Kolkata /etc/localtime && \