perf(docker): pin JVM container memory limits to stop host oversubscription (#1410)

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

Author: FelixTJDietrich

.changeset/jvm-memory-limits.md

@@ -0,0 +1,11 @@
+---
+"hephaestus": minor
+---
+
+The application-server, application-worker and webhook-server containers now have explicit memory
+limits, so each JVM sizes its heap for its own container instead of the whole host. Co-located
+services no longer oversubscribe host memory and push the box into swap.
+
+**Operators:** defaults are webhook-server 1 GB, application-server 5 GB, application-worker 3 GB,
+overridable via `WEBHOOK_SERVER_MEM_LIMIT`, `APPLICATION_SERVER_MEM_LIMIT` and
+`APPLICATION_WORKER_MEM_LIMIT`. Keep the sum under the host's RAM; raise them on larger hosts.

docker/compose.app.yaml

@@ -93,6 +93,9 @@ services:
 
   application-server:
     image: "ghcr.io/ls1intum/hephaestus/application-server:${IMAGE_TAG}"
+    # Bounds heap sizing to this container; without it the JVM targets host RAM and co-located
+    # services oversubscribe and swap. Hosts the NATS sync consumers, so it takes the largest limit.
+    mem_limit: ${APPLICATION_SERVER_MEM_LIMIT:-5g}
     ports:
       - "8080"
     environment:
@@ -291,6 +294,8 @@ services:
   # Worker runtime — same image, worker profile, no HTTP server, dials the hub over WSS.
   application-worker:
     image: "ghcr.io/ls1intum/hephaestus/application-server:${IMAGE_TAG}"
+    # Bounds heap sizing to this container (see application-server).
+    mem_limit: ${APPLICATION_WORKER_MEM_LIMIT:-3g}
     environment:
       APP_VERSION: ${IMAGE_TAG}
       SPRING_PROFILES_ACTIVE: prod,worker

docker/compose.core.yaml

@@ -8,6 +8,9 @@ services:
   # ─────────────────────────────────────────────────────────────────────────────
   webhook-server:
     image: "ghcr.io/ls1intum/hephaestus/application-server:${IMAGE_TAG}"
+    # Bounds heap sizing to this container; without it the JVM targets host RAM and co-located
+    # services oversubscribe and swap. Webhook only receives and republishes, so its heap is small.
+    mem_limit: ${WEBHOOK_SERVER_MEM_LIMIT:-1g}
     expose:
       - "8080"
     environment: