fix: resolve container OOM hangs from tsgo and --memory flag (#55)

* fix: resolve container OOM hangs from tsgo and --memory flag

Two issues caused containers to hang indefinitely:

1. Apple Container's `--memory` flag treats bare numbers as bytes, not
   megabytes. `--memory 1024` = 1024 bytes, causing the VM to never boot.
   Fix: use proper suffix (`--memory 4G`).
   Ref: apple/container#1202
   Ref: apple/container#1208

2. tsgo (TypeScript native compiler) has no default memory ceiling — Go
   doesn't auto-detect container memory limits, so tsgo allocates unbounded
   memory until the VM hangs under memory pressure.
   Fix: set GOMEMLIMIT=3GiB in entrypoint.
   Ref: microsoft/typescript-go#2125

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

* make container memory configurable via CONTAINER_MEMORY env var

Default 4G, configurable in .env. GOMEMLIMIT auto-derives from
actual VM memory (75%) so it scales with any CONTAINER_MEMORY value.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

Author: Peyton-Spencer

container/entrypoint.sh

@@ -7,6 +7,13 @@ set -e
 # Cap JS heap to prevent OOM
 export NODE_OPTIONS="--max-old-space-size=2048"
 
+# Cap Go heap for tsgo (TypeScript native compiler) — Go doesn't auto-detect
+# container memory limits, so without this tsgo allocates unbounded memory and hangs.
+# Set to 75% of available RAM, leaving headroom for OS + other processes.
+# See: https://github.com/microsoft/typescript-go/issues/2125
+TOTAL_KB=$(grep MemTotal /proc/meminfo | awk '{print $2}')
+export GOMEMLIMIT=$(( TOTAL_KB * 3 / 4 / 1024 ))MiB
+
 # Configure git with GitHub token
 if [ -n "$GITHUB_TOKEN" ]; then
   gh auth setup-git 2>/dev/null || true

src/backends/local-backend.ts

@@ -12,6 +12,7 @@ import path from 'path';
 import {
   CONTAINER_IMAGE,
   CONTAINER_MAX_OUTPUT_SIZE,
+  CONTAINER_MEMORY,
   CONTAINER_STARTUP_TIMEOUT,
   CONTAINER_TIMEOUT,
   DATA_DIR,
@@ -231,7 +232,7 @@ function buildVolumeMounts(
 }
 
 function buildContainerArgs(mounts: VolumeMount[], containerName: string): string[] {
-  const args: string[] = ['run', '-i', '--rm', '--name', containerName];
+  const args: string[] = ['run', '-i', '--rm', '--memory', CONTAINER_MEMORY, '--name', containerName];
 
   for (const mount of mounts) {
     if (mount.readonly) {

src/config.ts

@@ -29,6 +29,7 @@ export const MAIN_GROUP_FOLDER = 'main';
 
 export const CONTAINER_IMAGE =
   process.env.CONTAINER_IMAGE || 'nanoclaw-agent:latest';
+export const CONTAINER_MEMORY = process.env.CONTAINER_MEMORY || '4G';
 export const CONTAINER_TIMEOUT = parseInt(
   process.env.CONTAINER_TIMEOUT || '1800000',
   10,