feat(cli): add --memory-limit flag for configurable container memory by Mossaka · Pull Request #1243 · github/gh-aw-firewall

Mossaka · 2026-03-11T18:43:15Z

Summary

Reduces default agent container memory limit from 4GB to 2GB for better DoS protection in shared CI/CD environments
Adds --memory-limit CLI flag accepting Docker memory format (e.g., 2g, 512m, 8g) to override the default
Validates input format and rejects invalid values with clear error messages

Fixes #310

Test plan

Unit tests for parseMemoryLimit validation (valid formats, invalid formats, zero)
Unit test for custom memory limit passed through to Docker Compose config
Existing resource limit test updated to verify new 2g default
All 860 tests pass
Build and lint clean

🤖 Generated with Claude Code

Reduce default agent container memory from 4GB to 2GB for better DoS protection in shared environments. Add --memory-limit flag to override (e.g., --memory-limit 8g for AI agent workloads). Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

github-actions · 2026-03-11T18:44:11Z

✅ Coverage Check Passed

Overall Coverage

Metric	Base	PR	Delta
Lines	82.50%	82.56%	📈 +0.06%
Statements	82.50%	82.55%	📈 +0.05%
Functions	82.69%	82.77%	📈 +0.08%
Branches	74.78%	74.91%	📈 +0.13%

📁 Per-file Coverage Changes (2 files)

File	Lines (Before → After)	Statements (Before → After)
`src/docker-manager.ts`	84.0% → 84.5% (+0.54%)	83.3% → 83.8% (+0.52%)
`src/cli.ts`	47.0% → 47.8% (+0.72%)	47.5% → 48.1% (+0.69%)

Coverage comparison generated by scripts/ci/compare-coverage.ts

Copilot

Pull request overview

Adds a configurable memory limit for the agent execution container to improve resource-hardening in shared CI/CD environments, lowering the default memory cap while allowing explicit overrides via CLI.

Changes:

Introduces WrapperConfig.memoryLimit (documented default 2g) and wires it into Docker Compose generation for the agent container.
Adds --memory-limit CLI flag with validation (parseMemoryLimit) and passes the validated value into runtime config.
Updates and extends unit tests to cover the new default and custom overrides.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
src/types.ts	Adds `memoryLimit?: string` to `WrapperConfig` with docstring/default guidance.
src/docker-manager.ts	Uses `config.memoryLimit` (fallback `2g`) to set agent `mem_limit` / `memswap_limit`.
src/docker-manager.test.ts	Updates default resource limit assertions and adds a custom memory limit test.
src/cli.ts	Adds `--memory-limit` option, validation via `parseMemoryLimit`, and passes it into `WrapperConfig`.
src/cli.test.ts	Adds unit tests for `parseMemoryLimit` valid/invalid inputs.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Copilot · 2026-03-11T18:46:58Z

src/cli.ts

+export function parseMemoryLimit(input: string): { value: string; error?: undefined } | { value?: undefined; error: string } {
+  const pattern = /^(\d+)([bkmg])$/i;
+  const match = input.match(pattern);
+  if (!match) {
+    return { error: `Invalid --memory-limit value "${input}". Expected format: <number><unit> (e.g., 2g, 512m, 4g)` };
+  }
+  const num = parseInt(match[1], 10);
+  if (num <= 0) {
+    return { error: `Invalid --memory-limit value "${input}". Memory limit must be a positive number.` };
+  }
+  return { value: input.toLowerCase() };
+}


parseMemoryLimit matches the input string as-is; unlike other parsers in this file (e.g., DNS parsing), it doesn’t trim whitespace first. This causes values like "2g " (or values copied with trailing whitespace) to be rejected even though they’re otherwise valid. Consider normalizing with input.trim() (and returning the normalized value) before applying the regex.

Copilot · 2026-03-11T18:46:59Z

src/docker-manager.ts

+    mem_limit: config.memoryLimit || '2g',
+    memswap_limit: config.memoryLimit || '2g',  // No swap (same as mem_limit)


mem_limit and memswap_limit both repeat the same fallback expression. To avoid accidental divergence and make the default clearer, consider computing a single local value (e.g., memoryLimit = config.memoryLimit ?? '2g') and reusing it for both fields.

Copilot · 2026-03-11T18:46:59Z

src/cli.ts

+  .option(
+    '--memory-limit <limit>',
+    'Memory limit for the agent container (e.g., 1g, 2g, 4g, 512m). Default: 2g',
+    '2g'
+  )


PR description / issue acceptance criteria mention updating user-facing docs (README.md / AGENTS.md) for the new --memory-limit flag and the new 2g default, but this PR only changes code/tests. Either add the documentation updates or adjust the PR description so it matches what’s actually included.

github-actions · 2026-03-11T18:47:48Z

Smoke Test Results

✅ GitHub MCP: test(docker): verify capsh execution chain after PR #715 #1240 test(docker): verify capsh execution chain after PR fix: eliminate nested bash layer in chroot command execution for Java/.NET #715 | test: expand credential hiding tests to all 14 protected paths #1163 test: expand credential hiding tests to all 14 protected paths
✅ Playwright: github.com title contains "GitHub"
✅ File Write: /tmp/gh-aw/agent/smoke-test-claude-22968817364.txt created
✅ Bash: File contents verified

Overall: PASS

💥 [THE END] — Illustrated by Smoke Claude for issue #1243

github-actions · 2026-03-11T18:48:19Z

Smoke Test Results

✅ GitHub MCP: Last 2 merged PRs: test(docker): verify capsh execution chain after PR #715 #1240 "test(docker): verify capsh execution chain after PR fix: eliminate nested bash layer in chroot command execution for Java/.NET #715", fix(cli): clear LD_PRELOAD after one-shot-token library loads #1232 "fix(cli): clear LD_PRELOAD after one-shot-token library loads"
✅ Playwright: github.com title contains "GitHub"
✅ File Write: /tmp/gh-aw/agent/smoke-test-copilot-22968816768.txt created
✅ Bash: File verified via cat

Overall: PASS | Author: @Mossaka | No assignees

📰 BREAKING: Report filed by Smoke Copilot for issue #1243

github-actions · 2026-03-11T18:48:20Z

PR titles: test: expand credential hiding tests to all 14 protected paths; test(docker): verify capsh execution chain after PR #715; feat(cli): add --memory-limit flag for configurable container memory; feat(cli): add --agent-timeout flag for execution time limit
GitHub MCP (merged PRs): ✅
Safeinputs gh PR list: ✅
Playwright title check: ✅
Tavily search: ❌ (tool unavailable)
File write: ✅
Bash cat: ✅
Discussion query + comment: ✅
Build (npm ci && npm run build): ✅
Overall status: FAIL

🔮 The oracle has spoken through Smoke Codex for issue #1243

github-actions · 2026-03-11T18:49:06Z

Chroot Version Comparison Results

Runtime	Host Version	Chroot Version	Match?
Python	Python 3.12.12	Python 3.12.3	❌ NO
Node.js	v24.14.0	v20.20.0	❌ NO
Go	go1.22.12	go1.22.12	✅ YES

Result: ❌ Not all tests passed — Python and Node.js versions differ between host and chroot environment.

Tested by Smoke Chroot for issue #1243

github-actions · 2026-03-11T18:50:27Z

🏗️ Build Test Suite Results

Ecosystem	Project	Build/Install	Tests	Status
Bun	elysia	✅	1/1 passed	✅ PASS
Bun	hono	✅	1/1 passed	✅ PASS
C++	fmt	✅	N/A	✅ PASS
C++	json	✅	N/A	✅ PASS
Deno	oak	N/A	1/1 passed	✅ PASS
Deno	std	N/A	1/1 passed	✅ PASS
.NET	hello-world	✅	N/A	✅ PASS
.NET	json-parse	✅	N/A	✅ PASS
Go	color	✅	passed	✅ PASS
Go	env	✅	passed	✅ PASS
Go	uuid	✅	passed	✅ PASS
Java	gson	✅	1/1 passed	✅ PASS
Java	caffeine	✅	1/1 passed	✅ PASS
Node.js	clsx	✅	passed	✅ PASS
Node.js	execa	✅	passed	✅ PASS
Node.js	p-limit	✅	passed	✅ PASS
Rust	fd	✅	1/1 passed	✅ PASS
Rust	zoxide	✅	1/1 passed	✅ PASS

Overall: 8/8 ecosystems passed — ✅ PASS

Generated by Build Test Suite for issue #1243 · ◷

Copilot AI review requested due to automatic review settings March 11, 2026 18:43

Copilot started reviewing on behalf of Mossaka March 11, 2026 18:43 View session

Copilot AI reviewed Mar 11, 2026

View reviewed changes

github-actions bot added the smoke-claude label Mar 11, 2026

github-actions bot added the smoke-copilot label Mar 11, 2026

github-actions bot added the build-test label Mar 11, 2026

github-actions bot mentioned this pull request Mar 11, 2026

[agentics] No-Op Runs #1086

Open

Mossaka merged commit 1fe9e76 into main Mar 11, 2026
61 checks passed

Mossaka deleted the feat/092-memory-limit-config branch March 11, 2026 19:15

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(cli): add --memory-limit flag for configurable container memory#1243

feat(cli): add --memory-limit flag for configurable container memory#1243
Mossaka merged 1 commit intomainfrom
feat/092-memory-limit-config

Mossaka commented Mar 11, 2026

Uh oh!

github-actions bot commented Mar 11, 2026

Uh oh!

Copilot AI left a comment

Uh oh!

Copilot AI Mar 11, 2026

Uh oh!

Copilot AI Mar 11, 2026

Uh oh!

Copilot AI Mar 11, 2026

Uh oh!

github-actions bot commented Mar 11, 2026

Uh oh!

github-actions bot commented Mar 11, 2026

Uh oh!

github-actions bot commented Mar 11, 2026

Uh oh!

github-actions bot commented Mar 11, 2026

Uh oh!

github-actions bot commented Mar 11, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

		mem_limit: config.memoryLimit \|\| '2g',
		memswap_limit: config.memoryLimit \|\| '2g', // No swap (same as mem_limit)

Conversation

Mossaka commented Mar 11, 2026

Summary

Test plan

Uh oh!

github-actions bot commented Mar 11, 2026

✅ Coverage Check Passed

Overall Coverage

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Mar 11, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 11, 2026

Choose a reason for hiding this comment

Uh oh!

Copilot AI Mar 11, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions bot commented Mar 11, 2026

Smoke Test Results

Uh oh!

github-actions bot commented Mar 11, 2026

Smoke Test Results

Uh oh!

github-actions bot commented Mar 11, 2026

Uh oh!

github-actions bot commented Mar 11, 2026

Chroot Version Comparison Results

Uh oh!

github-actions bot commented Mar 11, 2026

🏗️ Build Test Suite Results

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants