u/Then_Respect_1964

First time using Solid Queue, Rails 8 defaults on a 512 MB Render box were running 7 processes
▲ 26 r/rails

First time using Solid Queue, Rails 8 defaults on a 512 MB Render box were running 7 processes

I usually run Sidekiq on a separate instance, but for a small Rails 8 API I tried Solid Queue for the first time, with the default setup running inside Puma.

On Render's 1 CPU with 512 MB it kept getting OOM-restarted. It looked like a leak, but the container was actually running 7 processes, each holding its own copy of the app.

Eventually found 2 things were multiplying them:

  • Render sets WEB_CONCURRENCY=1, which puts Puma in cluster mode: a master plus a worker, two copies of the app for no gain on a single core.
  • With SOLID_QUEUE_IN_PUMA, Solid Queue's supervisor forks separate processes for its dispatcher, worker and scheduler. "In Puma" still means more processes.

Switching Puma to single mode and Solid Queue to async mode (threads instead of forks) took it from 7 processes to 2.

I added a record of the fix here https://englog.dev/u/ndbaba1/cutting-rails-prod-memory-by-killing-hidden-fork

but curious how others run Solid Queue on small instances, async mode in the web process, or a separate worker service from the start?

u/Then_Respect_1964 — 7 days ago

We gave an AI agent a readonly Postgres login. It wasn’t as readonly as we thought

A while ago we had a Postgres login that was provisioned as read only for an AI agent we were working with.

At some point the agent tried to do something destructive with it. I honestly don’t remember the exact query anymore, this was a while back, but it made us actually inspect the login to see what it could do.

That was when I went down the rabbit hole of Postgres role inheritance. Just because you didn’t directly give a login UPDATE/DELETE etc doesn’t necessarily mean it can’t do those things. It can inherit privileges from other roles, own tables, have access through other grants etc.

We ended up putting together a small check internally to basically show us know what a given postgres login can actually do

I recently went back to that idea and built a small open source version of it called agent-db-scan.

You give it a Postgres connection string and it checks the effective privileges, inherited roles, tables it owns, whether it can write/delete/truncate, RLS, statement timeout, sensitive columns it can read, things like that.

Nothing too fancy, I just thought it might be useful for anyone giving Postgres credentials to agents or even just wanting to sanity check a supposedly restricted DB user before using it somewhere.

It’s open source, so feel free to use it or improve it

reddit.com
u/Then_Respect_1964 — 15 days ago

Arsenal fans in Vaughan / York Region?

Any Arsenal fans around Vaughan or York Region?

I’m trying to meet some fellow Gooners in the area. Would be nice to have a few people to watch games with or just talk Arsenal/football.

If you’re around the area, feel free to comment here or send me a message

reddit.com
u/Then_Respect_1964 — 1 month ago