How to set memory limit to a process in Golang

I use syscall prlimit to set resource limit to process, it works for limit CPU time but when test memory usage, I come with the problem.

package sandbox

import (
	"syscall"
	"unsafe"
)

func prLimit(pid int, limit uintptr, rlimit *syscall.Rlimit) error {
	_, _, errno := syscall.RawSyscall6(syscall.SYS_PRLIMIT64, uintptr(pid), limit, uintptr(unsafe.Pointer(rlimit)), 0, 0, 0)
	var err error
	if errno != 0 {
		err = errno
		return err
	} else {
		return nil
	}
}

and it's my test.

func TestMemoryLimit(t *testing.T) {
	proc, err := os.StartProcess("test/memo", []string{"memo"}, &os.ProcAttr{})
	if err != nil {
		panic(err)
	}
	defer proc.Kill()
	var rlimit syscall.Rlimit
	rlimit.Cur = 10
	rlimit.Max = 10 + 1024
	prLimit(proc.Pid, syscall.RLIMIT_DATA, &rlimit)
	status, err := proc.Wait()
	if status.Success() {
		t.Fatal("memory test failed")
	}
}

this is memo:

package main

func main() {
	var a [10000][]int
	for i := 0; i < 1000; i++ {
		a[i] = make([]int, 1024)
	}
}

I make a large amount of memory and set only 10 bytes for the memory , but it won't signal segment fault signal any way.

RLIMIT_DATA describes the maximum size of a processes data segment. Traditionally, programs that allocate memory enlarge the data segment with calls to brk() to allocate memory from the operating system.

Go doesn't use this approach. Instead, it uses a variant of the mmap() system call to request regions of memory anywhere in the address space. This is much more flexible than a brk() based approach as you can deallocate arbitrary memory regions with munmap(), whereas a brk() based approach can only deallocate memory from the end of the data segment.

The result of this is that RLIMIT_DATA is inneffective in controlling the amount of memory a process uses. Try using RLIMIT_AS instead, but beware that this limit also incorporates the address space you use for file mappings, especially in the case of shared libraries.

There is one proposal Soft memory limit, it may be released after go 1.18

> This option comes in two flavors: a new runtime/debug function called SetMemoryLimit and a GOMEMLIMIT environment variable. In sum, the runtime will try to maintain this memory limit by limiting the size of the heap, and by returning memory to the underlying platform more aggressively. This includes with a mechanism to help mitigate garbage collection death spirals. Finally, by setting GOGC=off, the Go runtime will always grow the heap to the full memory limit.

> This new option gives applications better control over their resource economy. It empowers users to:

> - Better utilize the memory that they already have,
> - Confidently decrease their memory limits, knowing Go will respect them,
> - Avoid unsupported forms of garbage collection tuning.

Update

This feature will be released in Go 1.19

> The runtime now includes support for a soft memory limit. This memory limit includes the Go heap and all other memory managed by the runtime, and excludes external memory sources such as mappings of the binary itself, memory managed in other languages, and memory held by the operating system on behalf of the Go program.

This limit may be managed via runtime/debug.SetMemoryLimit or the equivalent GOMEMLIMIT environment variable.

The limit works in conjunction with runtime/debug.SetGCPercent / GOGC, and will be respected even if GOGC=off, allowing Go programs to always make maximal use of their memory limit, improving resource efficiency in some cases.

Here are some suggestions about the memory limit usage per A Guide to the Go Garbage Collector

While the memory limit is a powerful tool, and the Go runtime takes steps to mitigate the worst behaviors from misuse, it's still important to use it thoughtfully. Below is a collection of tidbits of advice about where the memory limit is most useful and applicable, and where it might cause more harm than good.

• Do take advantage of the memory limit when the execution environment of your Go program is entirely within your control, and the Go program is the only program with access to some set of resources (i.e. some kind of memory reservation, like a container memory limit).

  A good example is the deployment of a web service into containers with a fixed amount of available memory.

  In this case, a good rule of thumb is to leave an additional 5-10% of headroom to account for memory sources the Go runtime is unaware of.

• Do feel free to adjust the memory limit in real time to adapt to changing conditions.

  A good example is a cgo program where C libraries temporarily need to use substantially more memory.

• Don't set GOGC to off with a memory limit if the Go program might share some of its limited memory with other programs, and those programs are generally decoupled from the Go program. Instead, keep the memory limit since it may help to curb undesirable transient behavior, but set GOGC to some smaller, reasonable value for the average case.

  While it may be tempting to try and "reserve" memory for co-tenant programs, unless the programs are fully synchronized (e.g. the Go program calls some subprocess and blocks while its callee executes), the result will be less reliable as inevitably both programs will need more memory. Letting the Go program use less memory when it doesn't need it will generate a more reliable result overall. This advice also applies to overcommit situations, where the sum of memory limits of containers running on one machine may exceed the actual physical memory available to the machine.

• Don't use the memory limit when deploying to an execution environment you don't control, especially when your program's memory use is proportional to its inputs.

  A good example is a CLI tool or a desktop application. Baking a memory limit into the program when it's unclear what kind of inputs it might be fed, or how much memory might be available on the system can lead to confusing crashes and poor performance. Plus, an advanced end-user can always set a memory limit if they wish.

• Don't set a memory limit to avoid out-of-memory conditions when a program is already close to its environment's memory limits.

  This effectively replaces an out-of-memory risk with a risk of severe application slowdown, which is often not a favorable trade, even with the efforts Go makes to mitigate thrashing. In such a case, it would be much more effective to either increase the environment's memory limits (and then potentially set a memory limit) or decrease GOGC (which provides a much cleaner trade-off than thrashing-mitigation does).