firezone / firezone / 41559607683

80%

push

github

feat(gateway): raise file descriptor limit (#16175)

The systemd units of the Gateway allowed 4096 open files. In Docker, the
Gateway used the soft limit of the container runtime, which is often
only 1024. A Gateway with many Clients can need more than that.

The systemd units (the `.deb` package, the install script and the NixOS
module) now allow 65536 open files. At startup, the Gateway also raises
its soft limit to the hard limit, which is usually 524288 or more in
Docker. The Gateway logs the old and the new limit. If it cannot raise
the limit, it logs this and continues with the old one.

A higher limit does not use more memory, because the kernel only
allocates memory for files that are open.

---

Related:
https://github.com/firezone/firezone/security/advisories/GHSA-j2vp-73ph-xcpm

1377 of 2287 branches covered (60.21%)

Branch coverage included in aggregate %.

94533 of 117454 relevant lines covered (80.49%)

369825.31 hits per line