fix: OOM integration test — force dirty pages for overcommit kernels\n\nbytearray(n) zero-initializes, but kernels with aggressive overcommit\n(GitHub Actions runners) use copy-on-write zero pages without committing\nreal RAM, so the OOM killer never fires and the test returns exit 0.\n\nFix: allocate b'x' * 10MB in a while-True loop. The non-zero bytes\nliteral forces every page dirty, requiring real physical memory commits.\nThe loop runs until the cgroup memory cap triggers OOM kill (exit 137).\n\nPasses locally (weftbox) and should now pass on GitHub Actions runners\nwhere the original bytearray approach returned exit 0.

Author: goweft

tests/test_integration.py

@@ -57,11 +57,20 @@ def test_integration_write_to_root_denied():
 
 def test_integration_oom_kill_captured():
     """--memory limit must trigger OOM kill (exit 137) on overshoot."""
-    # bytearray() touches every byte, so the kernel actually allocates
-    # and the OOM killer fires. 200 MB allocation against a 64 MB cap.
+    # bytearray(n) zero-initializes, but kernels with aggressive
+    # overcommit (e.g. GitHub Actions runners) use copy-on-write zero
+    # pages without committing real RAM — the OOM killer never fires.
+    # Fix: allocate b'x' * 10MB in a loop. The bytes literal is
+    # non-zero, so every page is dirty and the kernel must commit
+    # physical memory. The loop runs until OOM kills the process.
+    oom_script = (
+        "data = []\n"
+        "while True:\n"
+        "    data.append(b'x' * 10_000_000)\n"
+    )
     result = _docker_run(
         "--memory=64m", IMAGE,
-        "python", "-c", "bytearray(200_000_000)",
+        "python3", "-c", oom_script,
         timeout=30,
     )
     assert result.returncode == 137, (
@@ -88,9 +97,6 @@ def test_integration_egress_blocked_with_network_none():
         f"expected non-zero exit; got 0 (network was reachable). "
         f"stdout={result.stdout!r} stderr={result.stderr!r}"
     )
-    # Accept any of the common failure surfaces. The Python urllib call
-    # surfaces network unreachable / DNS failure depending on the kernel
-    # and resolver state; what matters is that it can't actually connect.
     stderr = result.stderr.decode("utf-8", errors="replace").lower()
     expected_signals = (
         "network is unreachable",