fix: prevent OOMKills by lowering GOMEMLIMIT and reducing allocations

ebpftracer/ebpf/l7/l7.c

@@ -104,15 +104,15 @@ struct iovec {
 };
 
 // Ring buffer for L7 events - provides global ordering across CPUs
-// Size: 16MB shared buffer (1 << 24 = 16777216 bytes)
+// Size: 8MB shared buffer (1 << 23 = 8388608 bytes)
 // Benefits over perf buffer:
 //   - Global event ordering (important for SSE streaming)
 //   - More efficient memory usage (shared vs per-CPU)
 //   - Backpressure via reserve/submit pattern
 // Requires kernel 5.8+
 struct {
     __uint(type, BPF_MAP_TYPE_RINGBUF);
-    __uint(max_entries, 1 << 24);  // 16MB
+    __uint(max_entries, 1 << 23);  // 8MB
 } l7_events SEC(".maps");
 
 struct read_args {

ebpftracer/tracer.go

@@ -417,8 +417,8 @@ type l7Event struct {
 	AddrFamily      uint16   // AF_INET (2) or AF_INET6 (10)
 	SocketInfoValid uint8    // 1 if socket info was extracted
 	Padding2        uint8
-	Payload         [8192]byte // Must match MAX_PAYLOAD_SIZE in eBPF
-	Response        [8192]byte // Must match MAX_PAYLOAD_SIZE in eBPF
+	Payload         [MaxPayloadSize]byte // Must match MAX_PAYLOAD_SIZE in eBPF
+	Response        [MaxPayloadSize]byte // Must match MAX_PAYLOAD_SIZE in eBPF
 }
 
 // lostSamplesTracker tracks lost samples per perf map and logs them periodically

main.go

@@ -127,14 +127,15 @@ func getClientSet() (*kubernetes.Clientset, error) {
 }
 
 func main() {
-	// Set GOMEMLIMIT to 90% of cgroup memory limit if available, otherwise use env var.
-	// This tells the Go GC to be more aggressive when approaching the limit,
-	// preventing OOMKills by trading CPU for lower memory usage.
+	// Set GOMEMLIMIT to 60% of cgroup memory limit if available, otherwise use env var.
+	// Use 60% (not 90%) because the cgroup OOM killer counts kernel memory (~80MB for
+	// eBPF maps) and file page cache (~200MB from /proc reads) which GOMEMLIMIT doesn't
+	// control. At 90%, Go heap + kernel + page cache exceeds the cgroup limit.
 	if os.Getenv("GOMEMLIMIT") == "" {
 		if limit, err := readCgroupMemoryLimit(); err == nil && limit > 0 {
-			softLimit := int64(float64(limit) * 0.9)
+			softLimit := int64(float64(limit) * 0.6)
 			debug.SetMemoryLimit(softLimit)
-			log.Printf("GOMEMLIMIT set to %dMiB (90%% of cgroup limit %dMiB)", softLimit/1024/1024, limit/1024/1024)
+			log.Printf("GOMEMLIMIT set to %dMiB (60%% of cgroup limit %dMiB)", softLimit/1024/1024, limit/1024/1024)
 		}
 	}