fix: graceful shutdown, L7 panic protection, bounded cache

[mayankpande88]

Summary

• Graceful shutdown (fix: graceful shutdown bypasses deferred cleanup due to os.Exit(0) #207): Replace os.Exit(0) with context cancellation so cr.Close(), profiling.Stop(), and resolver.StopWatching() run on SIGTERM. Use http.Server.Shutdown for clean HTTP termination. Previously leaked eBPF programs, uprobes, and perf buffers on every pod restart.
• L7 panic protection (fix: protocol parsers can panic on malformed input, crashing the agent #210): Wrap processL7Event and pending L7 retry with recover() to prevent a single malformed packet from crashing the entire agent and losing observability for the whole node.
• Bounded strippedGoExeCache (fix: strippedGoExeCache (sync.Map) grows unbounded #214): Replace unbounded sync.Map with hashicorp/golang-lru (already a dependency) capped at 1000 entries to prevent slow memory growth on CI/CD nodes with many unique short-lived Go binaries.

Test plan

• gofmt -l . passes
• Agent starts and shuts down cleanly on SIGTERM (deferred cleanup runs, logs "shutdown complete")
• Malformed L7 packets are logged and skipped instead of crashing the agent
• strippedGoExeCache evicts oldest entries when exceeding 1000

Closes #207, #210, #214

[gemini-code-assist]

Summary of Changes

Hello, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request significantly enhances the stability, resource management, and operational robustness of the agent. It introduces mechanisms for controlled shutdown, prevents critical failures from isolated L7 processing errors, and optimizes memory usage by bounding a previously unbounded cache. These changes collectively contribute to a more reliable and efficient agent, particularly in dynamic environments.

Highlights

• Graceful shutdown: Replaced os.Exit(0) with context cancellation to ensure proper cleanup of resources like cr.Close(), profiling.Stop(), and resolver.StopWatching() on SIGTERM, and used http.Server.Shutdown for clean HTTP termination, preventing eBPF program leaks.
• L7 panic protection: Implemented recover() around processL7Event and pending L7 retries to prevent the agent from crashing due to malformed L7 packets, ensuring continuous observability.
• Bounded cache: Replaced the unbounded sync.Map for strippedGoExeCache with a hashicorp/golang-lru cache capped at 1000 entries, addressing slow memory growth on CI/CD nodes with numerous short-lived Go binaries.

🧠 New Feature in Public Preview: You can now enable Memory to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console.

Changelog

• containers/registry.go
  • Added recover() to processL7Event to catch panics.
  • Introduced safeOnL7Request function to wrap onL7RequestWithResult with panic recovery for pending L7 retries.
  • Updated processPendingL7Events to use the new safeOnL7Request for safer L7 event processing.
• ebpftracer/tls.go
  • Replaced sync.Map with hashicorp/golang-lru/v2 for strippedGoExeCache.
  • Updated cache operations from Load/Store to Contains/Add respectively.
  • Removed sync import and added lru import.
• main.go
  • Imported the context package.
  • Modified signal handling to use context.WithCancel instead of os.Exit(0) for graceful shutdown.
  • Implemented http.Server.Shutdown for controlled HTTP server termination.
  • Added defer resolver.StopWatching() to ensure resolver cleanup.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	/gemini review	Performs a code review for the current pull request in its current state.
Pull Request Summary	/gemini summary	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	/gemini help	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Footnotes

1. Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

[gemini-code-assist]

Code Review

This pull request introduces several important reliability improvements: graceful shutdown handling, panic protection in L7 event processing, and a bounded cache for Go binaries to prevent memory leaks. The changes are well-implemented and address critical issues like resource leakage and agent crashes. I've added one suggestion for main.go to make the signal handling even more robust by stopping signal notifications after the first one is received.