Skip to content

fix: close HTTP response bodies to prevent OOM with many checks#1058

Open
dukelion wants to merge 1 commit into
goss-org:masterfrom
dukelion:fix/http-oom-response-body-cleanup
Open

fix: close HTTP response bodies to prevent OOM with many checks#1058
dukelion wants to merge 1 commit into
goss-org:masterfrom
dukelion:fix/http-oom-response-body-cleanup

Conversation

@dukelion

@dukelion dukelion commented May 7, 2026

Copy link
Copy Markdown

When running 100+ HTTP checks concurrently, response bodies were not always closed after validation. This caused unclosed TCP connections to accumulate, holding TLS state and transport buffers until the client timeout expired, leading to OOM kills under memory limits.

Checklist
  • make test-all (UNIX) passes. CI will also test this
  • unit and/or integration tests are included (if applicable)
  • documentation is changed or added (if applicable)

Description of change

Fixes OOM when goss is configured with many HTTP checks and limited RAM.

  • Add Close() to the system.HTTP interface and DefHTTP
  • Defer sysHTTP.Close() from HTTP resource validation for guaranteed cleanup
  • Always close resp.Body when Close() is called, including after a body matcher reads it
  • Add a unit test covering close-after-body-read behavior

@dukelion dukelion requested a review from aelsabbahy as a code owner May 7, 2026 10:00
@kgaughan

kgaughan commented Jun 8, 2026

Copy link
Copy Markdown
Contributor

Hi! I fixed the integration test pipelines recently. Could you rebase or merge from master? I checked you integration test failures, and most if not all of them would be fixed by that.

When running 100+ HTTP checks concurrently, response bodies were never
closed if the check only validated status and headers (no body matcher).
This caused unclosed TCP connections to accumulate, holding TLS state
and transport buffers until the 10s client timeout expired, leading to
OOM kills under memory limits.

Changes:
- Add Close() to system.HTTP interface and DefHTTP
- Track whether Body() consumed the response body
- Close() closes resp.Body if it wasn't consumed (i.e. status/headers-only checks)
- resource/http.go Validate() defers sysHTTP.Close() for guaranteed cleanup

Fixes OOM when goss is configured with many HTTP checks and limited RAM.
@dukelion dukelion force-pushed the fix/http-oom-response-body-cleanup branch from 54592bc to b13b130 Compare June 9, 2026 09:24
@dukelion

dukelion commented Jun 9, 2026

Copy link
Copy Markdown
Author

Rebased this branch onto current goss-org/master and force-pushed with lease.

I also tightened the cleanup path so DefHTTP.Close() closes resp.Body even after a body matcher reads it, and added a focused unit test for that lifecycle.

Local validation run on Windows:

  • go test ./system -run TestDefHTTPCloseClosesBodyAfterBodyRead
  • go test ./resource
  • git diff --check HEAD~1..HEAD

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants