chaos: add memory-pressure governor, restore Xmx to 2.5GiB

Throttles alloc-storm/direct-memory/dump-storm via cgroup memory
watermarks (85%/70%) instead of trimming heap to make off-heap
headroom. Validated: the jemalloc/2560m/profiler+tracer config that
OOMKilled in CI (job 1858271921) now completes cleanly under a real
6GiB-capped cgroup.

Author: jbachorik

ddprof-stresstest/src/chaos/java/com/datadoghq/profiler/chaos/AllocStormAntagonist.java

@@ -101,6 +101,7 @@ private void javaLoop() {
             buf[0] = (byte) idx;
             acc += buf[buf.length - 1];
             idx = (idx + 1) % SIZES.length;
+            MemoryGovernor.pace();
         }
         sink.addAndGet(acc);
     }
@@ -116,6 +117,7 @@ private void nativeLoop() {
                 long addr = (long) ALLOCATE_MEMORY.invoke(UNSAFE, NATIVE_BLOCK_SIZE);
                 acc += addr;
                 FREE_MEMORY.invoke(UNSAFE, addr);
+                MemoryGovernor.pace();
             }
         } catch (Throwable t) {
             // reflective failure; JVM crash is the signal we watch for

ddprof-stresstest/src/chaos/java/com/datadoghq/profiler/chaos/DirectMemoryAntagonist.java

@@ -88,6 +88,7 @@ private void ringLoop() {
             }
             slot = (slot + 1) % RING_SIZE;
             sizeIdx = (sizeIdx + 1) % RING_SIZES_BYTES.length;
+            MemoryGovernor.pace();
         }
         for (int i = 0; i < RING_SIZE; i++) {
             ring[i] = null;

ddprof-stresstest/src/chaos/java/com/datadoghq/profiler/chaos/DumpStormAntagonist.java

@@ -79,6 +79,7 @@ private void loop() {
                     return;
                 }
             }
+            MemoryGovernor.pace();
         }
     }
 

ddprof-stresstest/src/chaos/java/com/datadoghq/profiler/chaos/Main.java

@@ -42,6 +42,8 @@ public static void main(String[] args) throws Exception {
         Args parsed = Args.parse(args);
         log("starting duration=" + parsed.duration + " antagonists=" + parsed.antagonists);
 
+        MemoryGovernor.start();
+
         List<Antagonist> running = new ArrayList<>();
         try {
             for (String name : parsed.antagonists) {

ddprof-stresstest/src/chaos/java/com/datadoghq/profiler/chaos/MemoryGovernor.java

@@ -0,0 +1,123 @@
+/*
+ * Copyright 2026, Datadog, Inc
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ */
+package com.datadoghq.profiler.chaos;
+
+import java.io.IOException;
+import java.nio.charset.StandardCharsets;
+import java.nio.file.Files;
+import java.nio.file.Path;
+import java.nio.file.Paths;
+
+/**
+ * Shared memory-pressure gate for antagonists that burst allocations fast
+ * enough to threaten the container's cgroup ceiling before GC/Cleaner
+ * catches up (alloc-storm, direct-memory, dump-storm).
+ *
+ * <p>A single background thread samples the cgroup memory usage/limit (v2
+ * {@code memory.current}/{@code memory.max}, falling back to v1 {@code
+ * memory.usage_in_bytes}/{@code memory.limit_in_bytes}) and flips a shared
+ * {@code throttled} flag with hysteresis: entering throttle above {@link
+ * #HIGH_WATERMARK} of the limit, clearing it below {@link #LOW_WATERMARK}.
+ * Antagonists poll {@link #pace()} once per loop iteration — a volatile read
+ * plus, only while throttled, a short sleep. If no cgroup limit is readable
+ * (e.g. running outside a container), the governor stays permanently
+ * disabled rather than guessing at a ceiling.
+ */
+final class MemoryGovernor {
+
+    private static final double HIGH_WATERMARK = 0.85;
+    private static final double LOW_WATERMARK = 0.70;
+    private static final long SAMPLE_INTERVAL_MS = 500;
+    private static final long THROTTLE_SLEEP_MS = 5;
+
+    private static final Path[] USAGE_PATHS = {
+            Paths.get("/sys/fs/cgroup/memory.current"),
+            Paths.get("/sys/fs/cgroup/memory/memory.usage_in_bytes"),
+    };
+    private static final Path[] LIMIT_PATHS = {
+            Paths.get("/sys/fs/cgroup/memory.max"),
+            Paths.get("/sys/fs/cgroup/memory/memory.limit_in_bytes"),
+    };
+
+    private static volatile boolean throttled;
+
+    private MemoryGovernor() {
+    }
+
+    /** Starts the background sampler if a cgroup memory limit is readable. Idempotent-ish: call once from Main. */
+    static void start() {
+        Path usagePath = firstReadable(USAGE_PATHS);
+        long limitBytes = firstLimit(LIMIT_PATHS);
+        if (usagePath == null || limitBytes <= 0) {
+            return; // no container ceiling visible; never throttle
+        }
+        Thread sampler = new Thread(() -> sampleLoop(usagePath, limitBytes), "chaos-memory-governor");
+        sampler.setDaemon(true);
+        sampler.start();
+    }
+
+    /** Called from an antagonist's hot allocation loop. No-op unless throttled. */
+    static void pace() {
+        if (throttled) {
+            try {
+                Thread.sleep(THROTTLE_SLEEP_MS);
+            } catch (InterruptedException e) {
+                Thread.currentThread().interrupt();
+            }
+        }
+    }
+
+    private static void sampleLoop(Path usagePath, long limitBytes) {
+        while (true) {
+            try {
+                Thread.sleep(SAMPLE_INTERVAL_MS);
+                long usage = readLong(usagePath);
+                double fraction = (double) usage / (double) limitBytes;
+                if (fraction >= HIGH_WATERMARK) {
+                    throttled = true;
+                } else if (fraction <= LOW_WATERMARK) {
+                    throttled = false;
+                }
+            } catch (InterruptedException e) {
+                Thread.currentThread().interrupt();
+                return;
+            } catch (IOException | NumberFormatException e) {
+                // Transient read failure; keep last known state and retry next tick.
+            }
+        }
+    }
+
+    private static Path firstReadable(Path[] candidates) {
+        for (Path p : candidates) {
+            if (Files.isReadable(p)) {
+                return p;
+            }
+        }
+        return null;
+    }
+
+    private static long firstLimit(Path[] candidates) {
+        for (Path p : candidates) {
+            if (Files.isReadable(p)) {
+                try {
+                    return readLong(p);
+                } catch (IOException | NumberFormatException e) {
+                    // "max" (v2, unlimited) or unreadable; try the next candidate.
+                }
+            }
+        }
+        return -1;
+    }
+
+    private static long readLong(Path path) throws IOException {
+        String s = new String(Files.readAllBytes(path), StandardCharsets.US_ASCII).trim();
+        return Long.parseLong(s);
+    }
+}

utils/run-chaos-harness.sh

@@ -188,6 +188,14 @@ echo "LD_PRELOAD=${LD_PRELOAD:-}"
 CGROUP_MEM_LIMIT=$(cat /sys/fs/cgroup/memory/memory.limit_in_bytes 2>/dev/null || cat /sys/fs/cgroup/memory.max 2>/dev/null || echo "unknown")
 echo "cgroup memory limit: ${CGROUP_MEM_LIMIT}"
 
+# Container ceiling is 6GiB (see logged cgroup limit above). Job 1858271921
+# (profiler+tracer, jemalloc, 21.0.3-tem, aarch64) OOMKilled within seconds of
+# all 13 antagonists starting: several of them (alloc-storm, direct-memory,
+# dump-storm) deliberately burst off-heap/native memory hard and fast, sharing
+# the same cgroup limit as the heap. Reproduced under a 6GiB-capped cgroup and
+# confirmed MemoryGovernor (see chaos/MemoryGovernor.java, wired into the
+# antagonists' hot loops) keeps that same config under the limit, so the heap
+# no longer needs to be trimmed to make room for off-heap bursts.
 HEAP_MB=2560
 
 HS_ERR="${CHAOS_ERROR_FILE:-${WORK_DIR}/hs_err.log}"