clamd process memory balloons on first loading, causes out-of-memory hangs

[ksylvan]

Classification

• Crash/Hang/Data loss
• Feature/Enhancement

Reproducibility

• Always

Docker information

docker info

Client: Docker Engine - Community
 Version:    25.0.4
 Context:    default
 Debug Mode: false
 Plugins:
  buildx: Docker Buildx (Docker Inc.)
    Version:  v0.13.0
    Path:     /usr/libexec/docker/cli-plugins/docker-buildx
  compose: Docker Compose (Docker Inc.)
    Version:  v2.24.7
    Path:     /usr/libexec/docker/cli-plugins/docker-compose

docker images mailserver2/mailserver --digests --filter "dangling=false"

REPOSITORY               TAG       DIGEST                                                                    IMAGE ID       CREATED       SIZE
mailserver2/mailserver   1.1.16    sha256:815110bf4df220f3af619bb29ab0e814b9db87466c409377615be81584f6b3c0   f557f1fda03a   8 weeks ago   423MB

Description

The clamd process uses up so much memory on loading that it brings the system to a halt.

This is a known issue.

See https://betatim.github.io/posts/clamav-memory-usage/ for a possible workaround.

Steps to reproduce

1. docker-compose up -d
2. Wait about 30 seconds
3. Run "top" or "w" to see load averages up in the 60s.

My VPS has 2GB of RAM.

Expected results

Actual results

Debugging information

docker logs mailserver

Configuration (docker-compose.yml, traefik.toml...etc)

[AndrewSav]

IMO you need more memory. What was in minimum spec some years ago is out of date. To wit: I think it's normal and there is nothing that can be done about it - I'm observing similar.

[ksylvan]

@AndrewSav With the new clamd.conf configuration change, I'm not seeing the problem any more. See my PR.

[ksylvan]

@AndrewSav see my comments in PR #64 - I can now see my spam dashboard again. In the recent past, the rspamd page would often hang trying to render, and was very sluggish when it did render.

[AndrewSav]

Ah alright that sounds good.

[ksylvan]

Ah alright that sounds good.

Can you approve the PR and I'll go ahead and merge it then? @AndrewSav

[AndrewSav]

@ksylvan at the first opportunity!

[ksylvan]

@AndrewSav I merged the commit and closed this issue. Without setting CLAMD_MEORY_FIX, it was a no-op for existing installs, so basically there's zero risk of screwing up existing installations. And I ran it over the last few days on two production domains I have.