Ci on Luther Monson

ePHPm Odds and Ends: OOM-Killed Links, Opcode Scanning, WebSockets and a 44 ms Stall

Fri, 18 Sep 2026 20:05:00 -0700

Not every fix in ePHPm earns a full write-up. A few of the smaller ones have stuck with me because the lesson in each was bigger than the diff. Here are four from this summer.

A release build the OOM killer kept eating

ePHPm statically links libphp, ICU and a pile of other C libraries into one Rust binary. It ships for four targets. For the v0.4.2 performance release I set the release profile to lto = "fat" with codegen-units = 1 (#171). Fat LTO pulls every crate’s LLVM IR into one module in one process and optimizes it as a unit. One codegen unit removes the parallelism that would otherwise spread that memory out. That’s one very large process at the final link.

shipmates Short Ones: 8 Minutes Extracting Go, and Three Voice-Loop Bugs

Sat, 12 Sep 2026 14:35:00 -0700

A few shipmates bugs don’t need a whole post each. They were too good to leave in commit messages, though.

setup-go spends 8 minutes extracting Go on Windows CI

shipmates CI runs on my own ephemerd runners. On Windows those jobs run inside a Hyper-V utility VM. The windows-x64 leg kept timing out in actions/setup-go. Here’s the log from PR #48:

20:58:46  Setup go version spec 1.26.6
20:58:46  Attempting to download 1.26.6...     <- tool-cache MISS
20:58:48  Acquiring 1.26.6 from ...zip
20:58:53  Extracting Go...
21:06:46  ERROR: The action 'Run actions/setup-go@v5' has timed out after 8 minutes

Seven seconds from the start of the step to Extracting Go.... Then almost eight minutes extracting until the step timeout killed it.

Kata Containers for CI: Boot Cost Isn't the Problem, File I/O Is

Thu, 03 Sep 2026 21:35:00 -0700

Of the three platforms ephemerd runs jobs on, Linux has the weakest isolation. Windows jobs get a Hyper-V isolated container with its own kernel. macOS jobs get a whole VM. A Linux job is an ordinary runc container sharing the host kernel. A kernel escape from a Linux job is a host compromise. Kata Containers fixes that by putting each container in a lightweight VM with its own kernel. It plugs into containerd as just another runtime handler. So I added it in #155, measured it, and left it off by default. This post is why.