Repository navigation
Description
Out of memory: Killed process 1680404 (opencloud) total-vm:17239740kB, anon-rss:11584020kB, file-rss:0kB, shmem-rss:0kB, UID:1000 pgtables:24268kB oom_score_adj:0 2025-07-24T02:01:16.665086+02:00 pi kernel: [65667.196863] Out of memory: Killed process 1682955 (opencloud) total-vm:17025884kB, anon-rss:12785864kB, file-rss:0kB, shmem-rss:0kB, UID:1000 pgtables:26440kB oom_score_adj:0 2025-07-24T02:06:49.696520+02:00 pi kernel: [66000.187638] Out of memory: Killed process 1686575 (opencloud) total-vm:17176784kB, anon-rss:12798440kB, file-rss:0kB, shmem-rss:0kB, UID:1000 pgtables:26580kB oom_score_adj:0 2025-07-24T02:12:10.145965+02:00 pi kernel: [66320.669511] Out of memory: Killed process 1690485 (opencloud) total-vm:17882900kB, anon-rss:12787128kB, file-rss:0kB, shmem-rss:0kB, UID:1000 pgtables:27624kB oom_score_adj:0
Describe the bug
I removed about 100 GB of data and emptied the trash bin using the web interface.
After restarting the opencloud container, it started consuming all available RAM until it crashed and starts doing the same. Now since 2 days
Steps to reproduce
- delete 100 GB of files
- restart container
- check ram usage, syslog
Expected behavior
no crash :-)
Actual behavior
crash
Setup
OpenCloud 3.2.0
OpenCloud Web UI 3.2.0
docker-compose setup running in podman
Details
**console output**
2025-07-24T01:56:42.596890+02:00 pi kernel: [65393.075584] Out of memory: Killed process 1680404 (opencloud) total-vm:17239740kB, anon-rss:11584020kB, file-rss:0kB, shmem-rss:0kB, UID:1000 pgtables:24268kB oom_score_adj:0
2025-07-24T02:01:16.665086+02:00 pi kernel: [65667.196863] Out of memory: Killed process 1682955 (opencloud) total-vm:17025884kB, anon-rss:12785864kB, file-rss:0kB, shmem-rss:0kB, UID:1000 pgtables:26440kB oom_score_adj:0
2025-07-24T02:06:49.696520+02:00 pi kernel: [66000.187638] Out of memory: Killed process 1686575 (opencloud) total-vm:17176784kB, anon-rss:12798440kB, file-rss:0kB, shmem-rss:0kB, UID:1000 pgtables:26580kB oom_score_adj:0
2025-07-24T02:12:10.145965+02:00 pi kernel: [66320.669511] Out of memory: Killed process 1690485 (opencloud) total-vm:17882900kB, anon-rss:12787128kB, file-rss:0kB, shmem-rss:0kB, UID:1000 pgtables:27624kB oom_score_adj:0**docker logs**
endless no. of record lines written like:
2025/07/21 22:16:11 /var/lib/opencloud/storage/users/users/71497aeb-1e3b-499a-97eb-74110d009780/.oc-nodes/locks/,CREATE,c520f166-d3b2-4ab1-811c-e313ec9ec599.mlock
2025/07/21 22:16:11 /var/lib/opencloud/storage/users/users/71497aeb-1e3b-499a-97eb-74110d009780/.oc-nodes/locks/,"CLOSE_WRITE,CLOSE",c520f166-d3b2-4ab1-811c-e313ec9ec599.mlock
2025/07/21 22:16:11 /var/lib/opencloud/storage/users/users/71497aeb-1e3b-499a-97eb-74110d009780/.oc-nodes/locks/,DELETE,c520f166-d3b2-4ab1-811c-e313ec9ec599.mlock
$... grep -c DELETE
22217
$... grep -c CREATE
21985
$... grep -c CLOSE_WRITE
21966
**docker-compose.yml**
# Collabora ########################################
services:
collabora:
cap_add:
- MKNOD
command:
- coolconfig generate-proof-key && /start-collabora-online.sh
entrypoint:
- /bin/bash
- -c
environment:
DONT_GEN_SSL_CERT: yes
aliasgroup1: https://wopi.domain.tld:443
extra_params: |
--o:ssl.enable=false \
--o:ssl.ssl_verification=false \
--o:ssl.termination=true \
--o:welcome.enable=false \
--o:net.frame_ancestors=cloud.domain.tld
--o:welcome.enable=false
password: SECRET_PASSWORD
username: admin
healthcheck:
test:
- CMD
- curl
- -f
- http://localhost:9980/hosting/discovery
image: collabora/code:24.04.13.2.1
container_name: opencloud-wopi.app
restart: unless-stopped
ports:
- 9980:9980
network_mode: host
# labels:
# traefik.enable: "true"
# traefik.http.routers.collabora.entrypoints: https
# traefik.http.routers.collabora.rule: Host(`api.domain.tld`)
# traefik.http.routers.collabora.service: collabora
# traefik.http.routers.collabora.tls.certresolver: http
# traefik.http.services.collabora.loadbalancer.server.port: "9980"
# logging:
# driver: local
# Collaboration ##################################################
collaboration:
command:
- -c
- opencloud collaboration server
depends_on:
collabora:
condition: service_healthy
opencloud:
condition: service_started
entrypoint:
- /bin/sh
environment:
COLLABORATION_APP_ADDR: https://api.domain.tld
COLLABORATION_APP_ICON: https://api.domain.tld/favicon.ico
COLLABORATION_APP_INSECURE: "true"
COLLABORATION_APP_NAME: CollaboraOnline
COLLABORATION_APP_PRODUCT: Collabora
COLLABORATION_CS3API_DATAGATEWAY_INSECURE: "true"
COLLABORATION_GRPC_ADDR: 0.0.0.0:9301
COLLABORATION_HTTP_ADDR: 0.0.0.0:9300
COLLABORATION_LOG_LEVEL: error
COLLABORATION_WOPI_SRC: https://wopi.domain.tld
MICRO_REGISTRY: nats-js-kv
MICRO_REGISTRY_ADDRESS: 127.0.0.1:9233
OC_URL: https://cloud.domain.tld
image: opencloudeu/opencloud-rolling:latest
container_name: opencloud-api.app
ports:
- 9301:9301
- 9300:9300
network_mode: host
labels:
traefik.enable: "true"
traefik.http.routers.collaboration.entrypoints: https
traefik.http.routers.collaboration.rule: Host(`wopi.domain.tld`)
traefik.http.routers.collaboration.service: collaboration
traefik.http.routers.collaboration.tls.certresolver: http
traefik.http.services.collaboration.loadbalancer.server.port: "9300"
# logging:
# driver: local
restart: always
volumes:
- /docker/opencloud/config:/etc/opencloud:rw
# draw.io ##############################################
drawio-init:
command:
- -c
- cp -R /usr/share/nginx/html/draw-io/ /apps
entrypoint:
- /bin/sh
image: opencloudeu/web-extensions:draw-io-1.0.0
container_name: opencloud-drawio.app
user: root
volumes:
- /docker/opencloud/apps:/apps:rw
# externalsites.init #####################################
externalsites-init:
command:
- -c
- cp -R /usr/share/nginx/html/external-sites/ /apps
entrypoint:
- /bin/sh
image: opencloudeu/web-extensions:external-sites-1.0.0
container_name: opencloud-external_sites.app
user: root
volumes:
- /docker/opencloud/apps:/apps:rw
# jsonviewer.init ##############################################
jsonviewer-init:
command:
- -c
- cp -R /usr/share/nginx/html/json-viewer/ /apps
entrypoint:
- /bin/sh
image: opencloudeu/web-extensions:json-viewer-1.0.0
container_name: opencloud-json_viewer.app
user: root
volumes:
- /docker/opencloud/apps:/apps:rw
# opencloud ###############################################
opencloud:
command:
- -c
- opencloud init || true; opencloud server
ports:
- 9200:9200
- 9233:9233 #changed
network_mode: host
depends_on:
drawio-init:
condition: service_completed_successfully
externalsites-init:
condition: service_completed_successfully
jsonviewer-init:
condition: service_completed_successfully
progressbars-init:
condition: service_completed_successfully
unzip-init:
condition: service_completed_successfully
entrypoint:
- /bin/sh
environment:
COLLABORA_DOMAIN: api.domain.tld
COMPANION_DOMAIN: import.domain.tld
# FRONTEND_APP_HANDLER_SECURE_VIEW_APP_ADDR: eu.opencloud.api.collaboration.CollaboraOnline
GATEWAY_GRPC_ADDR: 0.0.0.0:9142
# GRAPH_AVAILABLE_ROLES: b1e2218d-eef8-4d4c-b82d-0f1a1b48f3b5,a8d5fe5e-96e3-418d-825b-534dbdf22b99,fb6c3e19-e378-47e5-b277-9732f9de6e21,58c63c02-1d89-4572-916a-870abc5a1b7d,2d00ce52-1fc2-4dbc-8b95-a73b73395f5a,1c996275-f1c9-4e71-abdf-a42f6495e960,312c0871-5ef7-4b3a-85b6-0e4074c64049,aa97fe03-7980-45ac-9e50-b325749fd7e6
IDM_ADMIN_PASSWORD: SECRET_PASSWORD
IDM_CREATE_DEMO_USERS: "false"
MICRO_REGISTRY_ADDRESS: 127.0.0.1:9233 #changed
NATS_NATS_HOST: 0.0.0.0
NATS_NATS_PORT: "9233"
NOTIFICATIONS_SMTP_AUTHENTICATION: auto
NOTIFICATIONS_SMTP_ENCRYPTION: starttls
NOTIFICATIONS_SMTP_HOST: smtp.domain.tls
NOTIFICATIONS_SMTP_INSECURE: "false"
NOTIFICATIONS_SMTP_PASSWORD: SECRET_PASSWORD
NOTIFICATIONS_SMTP_PORT: "587"
NOTIFICATIONS_SMTP_SENDER: OpenCloud notifications <noreply@domain.tld.de>
NOTIFICATIONS_SMTP_USERNAME: noreply@domain.tld.de
OC_ADD_RUN_SERVICES: notifications
OC_INSECURE: "false" #changed
OC_LOG_COLOR: "true"
OC_LOG_LEVEL: error
OC_LOG_PRETTY: "true"
STORAGE_USERS_POSIX_WATCH_FS: "true"
OC_PASSWORD_POLICY_BANNED_PASSWORDS_LIST: banned-password-list.txt
OC_URL: https://cloud.domain.tld
ONLYOFFICE_DOMAIN: onlyoffice.domain.tld
PROXY_CSP_CONFIG_FILE_LOCATION: /etc/opencloud/csp.yaml
PROXY_ENABLE_BASIC_AUTH: "false"
PROXY_TLS: "false"
SEARCH_EXTRACTOR_TYPE: tika
SEARCH_EXTRACTOR_TIKA_TIKA_URL: https://search.domain.tld
FRONTEND_FULL_TEXT_SEARCH_ENABLED: "true"
# Keycloak START
KEYCLOAK_DOMAIN: sso.domain.tld
PROXY_AUTOPROVISION_ACCOUNTS: "true"
PROXY_ROLE_ASSIGNMENT_DRIVER: oidc
OC_OIDC_ISSUER: https://sso.domain.tld/realms/openCloud
PROXY_OIDC_REWRITE_WELLKNOWN: "true"
PROXY_USER_OIDC_CLAIM: preferred_username
GRAPH_ASSIGN_DEFAULT_USER_ROLE: "false"
GRAPH_USERNAME_MATCH: none
OC_EXCLUDE_RUN_SERVICES: idp
WEB_OPTION_ACCOUNT_EDIT_LINK_HREF: https://sso.domain.tld/realms/openCloud/account
# Keycloak END
# Link password config START
# Disable the password policy.
# OC_PASSWORD_POLICY_DISABLED
# Define the minimum password length.
# OC_PASSWORD_POLICY_MIN_CHARACTERS
# Define the minimum number of uppercase letters.
# OC_PASSWORD_POLICY_MIN_LOWERCASE_CHARACTERS
# Define the minimum number of lowercase letters.
# OC_PASSWORD_POLICY_MIN_UPPERCASE_CHARACTERS
# Define the minimum number of digits.
# OC_PASSWORD_POLICY_MIN_DIGITS
# Define the minimum number of special characters.
# OC_PASSWORD_POLICY_MIN_SPECIAL_CHARACTERS
# Path to the ‘banned passwords list’ file.
# OC_PASSWORD_POLICY_BANNED_PASSWORDS_LIST
# Disable automatic Password protection for publich links
OC_SHARING_PUBLIC_SHARE_MUST_HAVE_PASSWORD: "false"
# Link password config END
image: opencloudeu/opencloud-rolling:latest
container_name: opencloud.app
# logging:
# driver: local
restart: unless-stopped
volumes:
- /docker/opencloud/config:/etc/opencloud:rw
- /docker/opencloud/app-registry.yaml:/etc/opencloud/app-registry.yaml:rw
- /docker/opencloud/apps.yaml:/etc/opencloud/apps.yaml:rw
- /docker/opencloud/config/banned-password-list.txt:/etc/opencloud/banned-password-list.txt:rw
- /docker/opencloud/csp.yaml:/etc/opencloud/csp.yaml:rw
- /docker/opencloud/data:/var/lib/opencloud:rw
- /docker/opencloud/apps:/var/lib/opencloud/web/assets/apps:rw
- /docker/opencloud/proxy.yaml:/etc/opencloud/proxy.yaml
# progress.init ####################################
progressbars-init:
command:
- -c
- cp -R /usr/share/nginx/html/progress-bars/ /apps
entrypoint:
- /bin/sh
image: opencloudeu/web-extensions:progress-bars-1.0.0
container_name: opencloud-progress_bars.app
user: root
volumes:
- /docker/opencloud/apps:/apps:rw
# traefik:
# command:
# - --log.level=ERROR
# - --certificatesResolvers.http.acme.email=postmaster@cscholz.io
# - --certificatesResolvers.http.acme.storage=/certs/acme.json
# - --certificatesResolvers.http.acme.httpChallenge.entryPoint=http
# - --certificatesResolvers.http.acme.caserver=https://acme-v02.api.letsencrypt.org/directory
# - --api.dashboard=true
# - --entryPoints.http.address=:80
# - --entryPoints.http.http.redirections.entryPoint.to=https
# - --entryPoints.http.http.redirections.entryPoint.scheme=https
# - --entryPoints.https.address=:443
# - --entryPoints.https.transport.respondingTimeouts.readTimeout=12h
# - --entryPoints.https.transport.respondingTimeouts.writeTimeout=12h
# - --entryPoints.https.transport.respondingTimeouts.idleTimeout=3m
# - --providers.docker.endpoint=unix:///var/run/docker.sock
# - --providers.docker.exposedByDefault=false
# - --accessLog=true
# - --accessLog.format=json
# - --accessLog.fields.headers.names.X-Request-Id=keep
# image: traefik:v3.3.1
# labels:
# traefik.enable: "false"
# traefik.http.middlewares.traefik-auth.basicauth.users: #admin:$$$$apr1$$$$4vqie50r$$$$YQAmQdtmz5n9rEALhxJ4l.
# traefik.http.routers.traefik.entrypoints: https
# traefik.http.routers.traefik.middlewares: traefik-auth
# traefik.http.routers.traefik.rule: Host(`traefik.opencloud.test`)
# traefik.http.routers.traefik.service: api@internal
# traefik.http.routers.traefik.tls.certresolver: http
# logging:
# driver: local
# networks:
# opencloud-net:
# aliases:
# - api.domain.tld
# - cloud.domain.tld
# - wopi.domain.tld
# ports:
# - published: 80
# target: 80
# - published: 443
# target: 443
# restart: always
# volumes:
# - certs:/certs:rw
# - /var/run/docker.sock:/var/run/docker.sock:ro
# unzip #################################
unzip-init:
command:
- -c
- cp -R /usr/share/nginx/html/unzip/ /apps
entrypoint:
- /bin/sh
image: opencloudeu/web-extensions:unzip-1.0.2
container_name: opencloud-unzip.app
user: root
volumes:
- /docker/opencloud/apps:/apps:rw
# tika #################################
tika-init:
image: tika:latest-full
container_name: opencloud-tika.app
# release notes: https://tika.apache.org
restart: unless-stopped
ports:
- 9998:9998
companion:
image: transloadit/companion:5.5.2
container_name: opencloud-companion.app
restart: unless-stopped
ports:
- 3020:3020
environment:
NODE_TLS_REJECT_UNAUTHORIZED: 0
COMPANION_CLIENT_ORIGINS: "true"
COMPANION_ALLOW_LOCAL_URLS: "true"
COMPANION_DATADIR: /tmp/companion/
COMPANION_DOMAIN: 127.0.0.1:9200
COMPANION_PROTOCOL: http
COMPANION_PATH: /companion
UPLOAD_URLS: import.domain.tld
COMPANION_ONEDRIVE_KEY: ""
COMPANION_ONEDRIVE_SECRET: ""
COMPANION_TUS_DEFERRED_UPLOAD_LENGTH: "false"
volumes:
- /docker/opencloud/companion:/tmp/companion/
# radicale #################################
radicale:
image: opencloudeu/radicale:latest
container_name: opencloud-radicale.app
restart: unless-stopped
ports:
- 5232:5232
volumes:
- /docker/opencloud/radicale/config:/etc/radicale/config
- /docker/opencloud/radicale/data/:/var/lib/radicale
networks: {}Additional context
Add any other context about the problem here.
Metadata
Metadata
Assignees
Labels
Type
Projects
- StatusShow more project fieldsDone
Activity
cscholz commentedon Jul 27, 2025
Every time I start the main opencloud container, it continuously runs into an out-of-memory (OOM) condition within 5 minutes.
I've used a script to visualize RAM Usage for here. It restarts automatically the container if the memory usage gets too high it restarts container
This is how it looks right now:
I'm currently unsure how to properly recover OpenCloud except limit ram usage by
But this left me with mixed feelings.
aduffeck commentedon Aug 1, 2025
@cscholz can you try to spin up opencloud without the search service (
OC_EXCLUDE_RUN_SERVICES=search) and check if you still get that level of memory usage? The current suspicion is that the bleve search index is the culprit here.aduffeck commentedon Aug 1, 2025
@cscholz I would also be interested to see how the system behaves when you set a GOMEMLIMIT, e.g.
GOMEMLIMIT=6GiBor so.cscholz commentedon Aug 2, 2025
OC_EXCLUDE_RUN_SERVICES=searchdid not solve the problem.GOMEMLIMIT=6GiBalso nottried also disabling
but container is still crashing
ns473 commentedon Sep 27, 2025
I think I got the same issue. No more crash after increasing RAM from 4GB to 8GB but lot of errors in logs (see attached)
I am running opencloud 3.5.0 in a virtual machine without docker.
Here what I've done before making the logs:
Here what I've done to make the log attached:
opencloud-delete.log
micbar commentedon Oct 6, 2025
@dragonchaser @flimmy Is that related to your findings?
flimmy commentedon Oct 6, 2025
AFAIK the Nats leak was only present in the Nightly.
dragonchaser commentedon Oct 6, 2025
AFAIK not even there, just in my faulty PR
cscholz commentedon Nov 4, 2025
As issue reporter I can update, that the issue did not occurred again in last versions.
Assume it is fixed. From my side, ca be closed.
4 remaining items
dragonchaser commentedon Nov 19, 2025
@dennisoderwald sorry oversaw that, will take a look
dragonchaser commentedon Nov 19, 2025
I have tried running it with 24GiB of RAM, I can not reproduce it on that machine.
I am assuming that there is some hard limit that is hit with your data in the cloud.
Closing this here.
If you want to do further experiments you could try to limit the amout of memory that is assigned to tika e.g. passing a argument
-JXmx4gto the tika process and see if the issue persists.ns473 commentedon Nov 19, 2025
dragonchaser commentedon Nov 19, 2025
Did you delete the files or did you just move them to the trash-bin?
ns473 commentedon Nov 19, 2025
fschade commentedon Nov 19, 2025
in the fix that was mentioned by @dragonchaser we've introduced batching to reduce the overall requests made (before the fix each change was 1 request to the search backend)!
the downside is, we have to keep track of each affected resource in memory! In combination with tika the sum of resources kept in memory could grow pretty fast (it can contain the whole content of that resource)!
In your case, I assume you're deleting the resources and not emptying the bin (deleting a resource just updates the storage location and marks the file as deleted).
this means:
the state is kept in memory till the limit is reached, right after, we send everything at once back to the search backend. The default size of a batch is 50 which means 50 times content size (+ some minor fields like id, name, path, ...).
can you do me a favor and try to decrease the batch size down to a smaller number?
SEARCH_BATCH_SIZE=Nbut please keep in mind, decreasing the batch size increases the requests made!
In certain scenarios the search service could be pretty resource hungry (tika, bleve, many upates, ...) depending on the content that is indexed, please try to find a sweet spot even if it means increasing the host memory.
please let us know if that solves your problem.
bs443 commentedon Dec 29, 2025
Hi, I am on Opencloud 4.1.0 rolling. I am using only Opencloud, no Tika, no Collabora etc.
When I uploaded lots of data into it, I experienced no problem.
However, when I deleted a folder that contains 40GB data and then emptied trash (all done on the web interface),
then my server's memory usage shot up to 26.9g and swap is also used and the total memory usage is about 50g.
I have tried all of the following and have verified that these environment variables were indeed set inside the docker container:
AUTOMEMEMLIMIT: off
AUTOMEMLIMIT: off
GOMEMLIMIT: 12GiB
GOGC: 5
SEARCH_BATCH_SIZE: 1
None of them worked. When I limited the docker to:
mem_limit: 24G
memswap_limit: 24G
And I watched docker stats, I saw the cpu and memory shot up initially and then settled at 1.9g. After 10 seconds, seems that bleve search kicked in (I guess my deletion of 40G data triggered a wholesale re-indexing) and then I saw the memory shot up until 24G and then it went down to 150M and shot up again to 24G and repeated.
The only thing that worked is to stop bleve search with this environment variable:
OC_EXCLUDE_RUN_SERVICES: search
My question 1: is AUTOMEMLIMIT and GOMEMLIMIT and GOGC not working?
My question 2: has anyone looked more into this?
I also tried Opencloud 4 stable. And it is the same result.
Thank you for your kind attention!
feat(search): hierarchy tokenizer for bleve path fields
feat(search): hierarchy tokenizer for bleve path fields
feat(search): hierarchy tokenizer for bleve path fields
feat(search): hierarchy tokenizer for bleve path fields
feat(search): hierarchy tokenizer for bleve path fields
feat(search): hierarchy tokenizer for bleve path fields