pallavithegod commented on code in PR #3360:
URL: https://github.com/apache/hugegraph/pull/3360#discussion_r4295082061
##########
hugegraph-server/hugegraph-dist/src/assembly/static/bin/util.sh:
##########
@@ -16,6 +16,50 @@
# limitations under the License.
#
+function record_jvm_startup_diagnostics() {
+ JVM_STARTUP_TIME=$(date -u +'%Y-%m-%d %H:%M:%S.%N UTC')
+ JVM_STARTUP_LOG_OFFSET=$(stat -c %s ./logs/hugegraph-server.log
2>/dev/null || echo 0)
+}
+
+function print_jvm_thread_hint() {
+ local kind
+ kind=$(awk '
+ /pthread_create.*\(EPERM\)|pthread_create.*Operation not permitted/ {
denied = 1 }
+ /[Tt]hread.*Operation not permitted/ { denied = 1 }
+ /Cannot create worker GC thread/ { resources = 1 }
+ END { if (denied) print "denied"; else if (resources) print
"resources" }
+ ')
+ case "$kind" in
+ denied)
+ echo 'ERROR: JVM thread creation was denied (EPERM). Check the
Docker host seccomp profile and thread limits.' >&2
+ echo 'To diagnose seccomp restrictions, retry with --security-opt
seccomp=unconfined; use a compatible host/runtime profile for normal
operation.' >&2
+ echo 'If the process limit is too low, set --ulimit
nproc=65535:65535.' >&2
+ ;;
+ resources)
+ echo 'ERROR: JVM could not create a GC worker thread. Check
available memory and process/thread limits.' >&2
+ echo 'If the process limit is too low, set --ulimit
nproc=65535:65535.' >&2
+ ;;
+ *) return 1 ;;
+ esac
+}
+
+function diagnose_jvm_startup_failure() {
+ local crash size offset
+ while IFS= read -r -d '' crash; do
+ if [[ -r "$crash" ]] && print_jvm_thread_hint < "$crash"; then
Review Comment:
Updated in a24c32d1b using the suggested generic-hint approach. A generic
GC-thread crash now lists seccomp denial alongside memory and process limits
and directs readers to the preceding JVM stdout for EPERM. The process fixtures
now put the EPERM warning on stdout and only the generic header in the crash
file, including init-store exit-status coverage. The entrypoint/process
fixtures, RAT, repository Checkstyle, clean compilation, and
HugeSecurityManagerTest pass.
##########
hugegraph-server/hugegraph-dist/src/assembly/static/bin/util.sh:
##########
@@ -16,6 +16,50 @@
# limitations under the License.
#
+function record_jvm_startup_diagnostics() {
+ JVM_STARTUP_TIME=$(date -u +'%Y-%m-%d %H:%M:%S.%N UTC')
+ JVM_STARTUP_LOG_OFFSET=$(stat -c %s ./logs/hugegraph-server.log
2>/dev/null || echo 0)
+}
+
+function print_jvm_thread_hint() {
+ local kind
+ kind=$(awk '
+ /pthread_create.*\(EPERM\)|pthread_create.*Operation not permitted/ {
denied = 1 }
+ /[Tt]hread.*Operation not permitted/ { denied = 1 }
+ /Cannot create worker GC thread/ { resources = 1 }
+ END { if (denied) print "denied"; else if (resources) print
"resources" }
+ ')
+ case "$kind" in
+ denied)
+ echo 'ERROR: JVM thread creation was denied (EPERM). Check the
Docker host seccomp profile and thread limits.' >&2
+ echo 'To diagnose seccomp restrictions, retry with --security-opt
seccomp=unconfined; use a compatible host/runtime profile for normal
operation.' >&2
+ echo 'If the process limit is too low, set --ulimit
nproc=65535:65535.' >&2
Review Comment:
Updated in a24c32d1b. The EPERM-specific branch now refers only to
seccomp/security policy, with no thread-limit or nproc advice. The README
distinguishes EPERM from EAGAIN, and a focused assertion checks that the EPERM
hint contains no process-limit advice.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]
