Excessive usage of SWAP

[LiloBzH]

What happened?

I have a log of SWAP used

CONTAINER ID RSS(MiB) SWAP(MiB) TOTAL(MiB)

bunkerweb-bunkerweb-1 x 174 2619 2793
bunkerweb-bw-ui-1 xxxx 50 338 388
bunkerweb-bw-db-1 xxx 11 337 348
bunkerweb-bw-scheduler-1 x 27 47 74

Uptime : 2 hours.

Server : Proxmox
RAM : 16G in Proxmox , 12G for CT

RAM memory is constantly used at around 40%.
SWAP increases very quickly and is between 90 and 100%.

78118: 470076 kB - nginx: worker process
78120: 468796 kB - nginx: worker process
78119: 468412 kB - nginx: worker process
78122: 465724 kB - nginx: worker process
78121: 462908 kB - nginx: worker process
74202: 461684 kB - nginx: master process nginx -g daemon off;

It is clearly NGINX that consumes a lot

Usage of Bunkerweb : 10 services with default option

How to reproduce?

Reboot Docker Bunkerweb or reboot CT > same thing

Configuration file(s) (yaml or .env)

Global :

MULTISITE=yes
API_WHITELIST_IP=127.0.0.0/8 10.20.30.0/24
ANTIBOT_RECAPTCHA_SITEKEY=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
ANTIBOT_RECAPTCHA_SECRET=xxxxxxxxxxxxxxxxxxxxx-xxxxxxxxxxxxxxxxxxx
USE_BUNKERNET=no
AUTO_LETS_ENCRYPT=yes
EMAIL_LETS_ENCRYPT=xxxxxxxxxx@xxxxxxxxxx.com
SECURITYTXT_PREFERRED_LANG=fr
UI_HOST=http://bw-ui:7000

Exemple of service

IS_DRAFT=no
SERVER_NAME=xxxxxxxxxxxxxxxx.com
ANTIBOT_RECAPTCHA_SITEKEY=xxxxxxxxxxxxxxxxxxxxxxxxxxxxx
ANTIBOT_RECAPTCHA_SECRET=xxxxxxxxxxxxxxxxxxxxx-xxxxxxxxxxxxxxxxx
USE_AUTH_BASIC=yes
AUTH_BASIC_USER=xxxxxxx
AUTH_BASIC_PASSWORD=xxxxxxxxxxx
USE_BUNKERNET=no
WHITELIST_COUNTRY=FR
AUTO_LETS_ENCRYPT=yes
EMAIL_LETS_ENCRYPT=xxxxxxxxxxx-bunkerweb@xxxxxx.com
ALLOWED_METHODS=GET|POST|HEAD|PUT
USE_REVERSE_PROXY=yes
REVERSE_PROXY_INTERCEPT_ERRORS=no
REVERSE_PROXY_HOST=http://192.168.xxxxxxxxxxxxxx
REVERSE_PROXY_WS=yes
SECURITYTXT_PREFERRED_LANG=fr

x-bw-env: &bw-env
  # We use an anchor to avoid repeating the same settings for both services
  API_WHITELIST_IP: "127.0.0.0/8 10.20.30.0/24" # Make sure to set the correct IP range so the scheduler can send the configuration to the instance
  DATABASE_URI: "mariadb+pymysql://xxxxxxxxx:xxxxxxxxx:3306/db" # Remember to set a stronger password for the database
  TZ: "Europe/Paris"

services:
  bunkerweb:
    # This is the name that will be used to identify the instance in the Scheduler
    image: bunkerity/bunkerweb:1.6.4
    ports:
      - "80:8080/tcp"
      - "443:8443/tcp"
      - "443:8443/udp" # For QUIC / HTTP3 support
    environment:
      <<: *bw-env # We use the anchor to avoid repeating the same settings for all services
    restart: "unless-stopped"

    networks:
      - bw-universe
      - bw-services

  bw-scheduler:
    image: bunkerity/bunkerweb-scheduler:1.6.4
    environment:
      <<: *bw-env
      BUNKERWEB_INSTANCES: "bunkerweb" # Make sure to set the correct instance name
      SERVER_NAME: "bunkerweb.domaine.com"
      MULTISITE: "yes"
      UI_HOST: "http://bw-ui:7000" # Change it if needed
      bunkerweb.domaine.com_USE_TEMPLATE: "ui"
      bunkerweb.domaine.com_USE_REVERSE_PROXY: "yes"
      bunkerweb.domaine.com_REVERSE_PROXY_URL: "/admin" # Change it to a hard to guess URI
      bunkerweb.domaine.com_REVERSE_PROXY_HOST: "http://bw-ui:7000"
    volumes:
      - bw-storage:/data # This is used to persist the cache and other data like the backups
    restart: "unless-stopped"
    networks:
      - bw-universe
      - bw-db

  bw-ui:
    image: bunkerity/bunkerweb-ui:1.6.4
    environment:
      <<: *bw-env
    volumes:
      - bw-ui:/data # This is used to persist the cache and other data like the backups
    restart: "unless-stopped"
    networks:
      - bw-universe
      - bw-db

  bw-db:
    image: mariadb:11
    environment:
      MYSQL_RANDOM_ROOT_PASSWORD: "yes"
      MYSQL_DATABASE: "db"
      MYSQL_USER: "xxxxxxxxxxxxx"
      MYSQL_PASSWORD: "xxxxxxxxxxxxxxx" # Remember to set a stronger password for the database
    volumes:
      - bw-data:/var/lib/mysql
    restart: "unless-stopped"
    networks:
      - bw-db

volumes:
  bw-data:
  bw-storage:
  bw-ui:

networks:
  bw-universe:
    name: bw-universe
    ipam:
      driver: default
      config:
        - subnet: 10.20.30.0/24 # Make sure to set the correct IP range so the scheduler can send the configuration to the instance
  bw-services:
    name: bw-services
  bw-db:
    name: bw-db

Relevant log output

no specific error

BunkerWeb version

1.6.4

What integration are you using?

Docker

Linux distribution (if applicable)

Proxmox 9.0.10 ( CT )

Removed private data

• I have removed all private data from the configuration file and the logs

Code of Conduct

• I agree to follow this project's Code of Conduct

[TheophileDiot]

Hi @LiloBzH, did you read this section of the documentation ?

[LiloBzH]

Hi @LiloBzH, did you read this section of the documentation ?

Yes, but I didn't think 10 services were considered a lot.

I'll test it out and see.

[LiloBzH]

I try :

command: --max_allowed_packet=64M

in stack of mysql

and i have enable "ModSecurity global CRS mode"

test in progress !

[TheophileDiot]

Alright, sorry for the inconvenience, ModSecurity has issues regarding memory:

• High RAM Usage with Concurrent Logging Mode in ModSecurity owasp-modsecurity/ModSecurity#3414