How to use systemd-run to isolate the rest of the system from a rogue program triggering the oom killer

Question

I'm wanting to use cgroups and systemd-run to insulate the rest of my system from rogue programs that wake the OOM killer.

In particular, clangd is hogging all my memory and then some, and then triggering the OOM Killer.

That's a separate problem and a separate question. (Although any answers welcome)

This question is about why my usage of systemd-run isn't working.

If I wrap it like so...

systemd-run --user --scope -p MemoryHigh=3G clangd --clang-tidy --malloc-trim --log=info --background-index -j 8 --pch-storage=disk --background-index-priority=low

It doesn't stop it from going hog wild and the OOM killer killing my gnome session and making me log in again!

I have tried MemoryMax=5G and it doesn't make a difference.

Details of my setup are....

• Ubuntu Noble 24.04 LTS
• clangd 18.1.3
• MemTotal: 16101600 kB
• SwapTotal: 5242876 kB
• Linux version 6.8.0-41-generic (buildd@lcy02-amd64-100) (x86_64-linux-gnu-gcc-13 (Ubuntu 13.2.0-23ubuntu4) 13.2.0, GNU ld (GNU Binutils for Ubuntu) 2.42) #41-Ubuntu SMP PREEMPT_DYNAMIC Fri Aug 2 20:41:06 UTC 202

systemd-run --version systemd 255 (255.4-1ubuntu8.4) +PAM +AUDIT +SELINUX +APPARMOR +IMA +SMACK +SECCOMP +GCRYPT -GNUTLS +OPENSSL +ACL +BLKID +CURL +ELFUTILS +FIDO2 +IDN2 -IDN +IPTC +KMOD +LIBCRYPTSETUP +LIBFDISK +PCRE2 -PWQUALITY +P11KIT +QRENCODE +TPM2 +BZIP2 +LZ4 +XZ +ZLIB +ZSTD -BPF_FRAMEWORK -XKBCOMMON +UTMP +SYSVINIT default-hierarchy=unified 

References I'm using...

• https://www.freedesktop.org/software/systemd/man/latest/systemd.resource-control.html#Memory%20Accounting%20and%20Control
• https://www.freedesktop.org/software/systemd/man/latest/systemd-run.html#

Answer 1

Ok, I have worked out what my problem was.....

clang AND clangd have a bug.

https://github.com/llvm/llvm-project/issues/107516

This confused my testing, since I perceived it as purely clangd problem, since clangd uses clang and a bunch of other stuff.

Thus clangd would always trigger the OOM killer before clang did.

So actually my insulation worked. But when I used clang, on top of the resources I allowed clangd, it also triggered the OOM killer killing my gnome session.

So I'm currently running it as...

systemd-run --unit=clungd --user --scope -p MemoryMax=3G -p MemoryHigh=2500M clangd --clang-tidy --malloc-trim --log=info --background-index -j 4 --background-index-priority=low 

...and it all works fine, and when clangd gets too greedy it starts swapping like mad (but just clangd) and then if it really gets greedy the OOM killer wakes and kills just it.