Add container resource limits for all services

Set memory, CPU, and PID limits: MySQL Server (2G/2CPU/500), MySQL Mgmt
(1G/1CPU/200), Redis (768M/0.5CPU/100), Superset (2G/2CPU). Prevents
OOM kills and noisy-neighbor resource starvation between services.
memswap_limit equals mem_limit to disable swap for all containers.

Closes #73

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: szachovy

CHANGELOG.md

@@ -15,6 +15,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 * Dependabot updates for `github-actions` and `terraform` ecosystems. (#29)
 * CI workflow to build and push service images to GitHub Container Registry on master merge. (#97)
 * Pull-first with local build fallback for container images during deployment. (#97)
+* Container resource limits (memory, CPU, PIDs) for all services. (#73)
 
 ### Changed
 

services/mysql-mgmt/docker_compose.yml

@@ -100,6 +100,10 @@ services:
     image: "ghcr.io/szachovy/superset-cluster-mysql-mgmt:latest"
     pull_policy: "missing"
     user: "superset"
+    mem_limit: "1g"
+    memswap_limit: "1g"
+    cpus: 1.0
+    pids_limit: 200
     entrypoint:
       - "/bin/bash"
       - "-c"

src/container.py

@@ -236,6 +236,10 @@ def run(self) -> None:
                     network="host",
                     cap_add=["SYS_NICE"],
                     security_opt=[f"seccomp={seccomp_parsed}"],
+                    mem_limit="2g",
+                    memswap_limit="2g",
+                    nano_cpus=2000000000,
+                    pids_limit=500,
                     environment={
                         "MYSQL_INITDB_SKIP_TZINFO": "true",
                         "MYSQL_ROOT_PASSWORD_FILE": "/var/run/mysqld/mysql_root_password",
@@ -399,6 +403,10 @@ def run(self) -> None:
                     name="redis",
                     hostname="redis",
                     network="superset-network",
+                    mem_limit="768m",
+                    memswap_limit="768m",
+                    nano_cpus=500000000,
+                    pids_limit=100,
                     healthcheck={
                         'test': ["CMD", "redis-cli", "ping"],
                         'interval': self.healthcheck_interval * 1000000000,
@@ -456,6 +464,10 @@ def run(self) -> None:
                     ],
                     maxreplicas=1,
                     env=[f"VIRTUAL_IP_ADDRESS={self.virtual_ip_address}"],
+                    resources=docker.types.Resources(
+                        mem_limit=2147483648,
+                        nano_cpus=2000000000
+                    ),
                     endpoint_spec=docker.types.EndpointSpec(
                         mode="vip",
                         ports={443: 443}