fix: migrate pids_limit to deploy.resources.limits.pids by Aureliolo · Pull Request #439 · Aureliolo/synthorg

Aureliolo · 2026-03-15T12:12:49Z

Summary

Migrate deprecated top-level pids_limit to deploy.resources.limits.pids in all compose files
Fixes DAST CI failure caused by newer Docker Compose (v2.32+) rejecting duplicate pids declarations when both pids_limit and deploy.resources.limits are present
Updated: docker/compose.yml, CLI compose template, and golden test files

Test plan

Go CLI tests pass (go test ./...) — golden file comparisons verify correct YAML output
Pre-commit hooks pass
DAST workflow succeeds on main after merge

Review coverage

Quick mode — automated checks only (infra-only change, no source code modified).

Newer Docker Compose (v2.32+) rejects top-level `pids_limit` when `deploy.resources.limits` is also present, causing DAST CI failure. Move to the canonical `deploy.resources.limits.pids` location.

Same pids_limit to deploy.resources.limits.pids migration for the development compose file (missed in previous commit).

github-actions · 2026-03-15T12:12:59Z

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None

gemini-code-assist · 2026-03-15T12:13:04Z

Summary of Changes

Hello, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request addresses a compatibility issue with recent Docker Compose versions by updating how process ID limits are configured. It migrates the deprecated top-level pids_limit setting to the deploy.resources.limits.pids structure, resolving DAST CI failures that occurred when both declarations were present. This ensures continued functionality and adherence to current Docker Compose best practices without altering application source code.

Highlights

Configuration Migration: Migrated the deprecated top-level pids_limit configuration to deploy.resources.limits.pids across all relevant Docker Compose files.
CI Fix: Resolved a DAST CI failure caused by newer Docker Compose versions (v2.32+) rejecting duplicate PIDs declarations when both the old and new configurations were present.
File Updates: Updated the main docker/compose.yml, the CLI compose template (cli/internal/compose/compose.yml.tmpl), and associated golden test files (cli/testdata/compose_custom_ports.yml, cli/testdata/compose_default.yml) to reflect this configuration change.

Changelog

cli/internal/compose/compose.yml.tmpl
- Updated the template to use the new deploy.resources.limits.pids configuration.
cli/testdata/compose_custom_ports.yml
- Modified the golden test file to reflect the updated PIDs limit configuration.
cli/testdata/compose_default.yml
- Modified the golden test file to reflect the updated PIDs limit configuration.
docker/compose.yml
- Updated the main Docker Compose file to use the new deploy.resources.limits.pids configuration.

Activity

The author, Aureliolo, created this pull request.
Automated checks have been run, confirming that CLI tests pass and pre-commit hooks are successful.
No human review activity has been recorded yet, as this is an infrastructure-only change.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	`/gemini review`	Performs a code review for the current pull request in its current state.
Pull Request Summary	`/gemini summary`	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	`/gemini help`	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

coderabbitai · 2026-03-15T12:13:15Z

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 2d337c68-7ba6-4217-be9c-70e88267fae9

📥 Commits

Reviewing files that changed from the base of the PR and between b22abfd and 770b7c0.

📒 Files selected for processing (1)

docs/security.md

📝 Walkthrough

Summary by CodeRabbit

Refactor
- Migrated per-service PID limits into resource limit specifications for backend (256), web (64) and sandbox, preserving existing limits.
Documentation
- Security/resource-limits guidance updated to explicitly include per-container PID limits and reflect the new configuration style.

Walkthrough

Migrate Docker Compose PID settings from pids_limit to deploy.resources.limits.pids across templates, compose files, and docs; numeric PID values are unchanged.

Changes

Cohort / File(s)	Summary
Compose templates & primary compose `cli/internal/compose/compose.yml.tmpl`, `docker/compose.yml`	Replaced per-service `pids_limit` entries with `deploy.resources.limits.pids` for backend, web, and sandbox services; preserved numeric values (backend 256, web 64).
Testdata compose files `cli/testdata/compose_custom_ports.yml`, `cli/testdata/compose_default.yml`	Removed `pids_limit` and added `deploy.resources.limits.pids` for backend and web services with the same values.
Documentation `docs/security.md`	Updated CIS/resource-limits guidance to reference `deploy.resources.limits.pids` and list per-container PID counts (backend 256, web 64).

Estimated code review effort

🎯 2 (Simple) | ⏱️ ~10 minutes

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title directly and accurately describes the main change: migrating pids_limit to deploy.resources.limits.pids across compose files.
Description check	✅ Passed	The description clearly explains the migration change, the reason for it (Docker Compose v2.32+ compatibility), and references all affected files.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests
Post copyable unit tests in a comment
Commit unit tests in branch fix/compose-pids-limit

✨ Simplify code

Create PR with simplified code
Commit simplified code in branch fix/compose-pids-limit

📝 Coding Plan

Generate coding plan for human review comments

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

gemini-code-assist

Code Review

This pull request migrates the deprecated pids_limit to deploy.resources.limits.pids across all relevant Docker Compose files. The changes are applied consistently to the compose template, golden test files, and the development compose.yml. This correctly addresses the described issue with newer Docker Compose versions. The implementation is correct and I have no further comments.

greptile-apps · 2026-03-15T12:14:34Z

Greptile Summary

This PR migrates the deprecated top-level pids_limit key to deploy.resources.limits.pids across all Docker Compose files to fix CI failures caused by Docker Compose v2.32+ rejecting the old key when deploy.resources.limits is already present. All pids values are preserved correctly (backend: 256, web: 64, sandbox: 128 in the template), golden test files are kept in sync, and docs/security.md is updated to reflect the new key in the CIS 5.28 row and the resource-limits prose.

All three services in compose.yml.tmpl (backend, web, sandbox) and both services in docker/compose.yml are correctly updated — no pids_limit references remain in any compose file.
cli/testdata/compose_default.yml and cli/testdata/compose_custom_ports.yml golden files match the expected template output, keeping go test ./... green.
docs/security.md now accurately references deploy.resources.limits.pids for CIS 5.28 and lists PID counts alongside memory/CPU in the resource-limits sentence.
No functional or security regressions introduced — the effective PID caps are identical to before the change.

Confidence Score: 5/5

This PR is safe to merge — it is a mechanical, non-breaking migration of a deprecated Docker Compose key with no logic changes.
All pids values are faithfully preserved, every affected file (template, static compose, golden test files, docs) has been updated consistently, and no pids_limit references remain in any compose file. The change is purely syntactic and carries no security or functional risk.
No files require special attention.

Important Files Changed

Filename	Overview
cli/internal/compose/compose.yml.tmpl	Removes top-level `pids_limit` from backend (256), web (64), and sandbox (128) services; adds equivalent `pids` field under existing `deploy.resources.limits` block for all three services. Values are preserved correctly.
docker/compose.yml	Same migration applied to the static dev compose file for backend (256) and web (64) services. No sandbox service here, consistent with the pre-existing file structure.
cli/testdata/compose_default.yml	Golden test file updated to mirror the template output — `pids_limit` removed and `pids: 256` / `pids: 64` added under `deploy.resources.limits` for backend and web respectively.
cli/testdata/compose_custom_ports.yml	Golden test file for custom-ports scenario updated identically to `compose_default.yml`; pids values are correct and consistent.
docs/security.md	CIS 5.28 row updated to reference `deploy.resources.limits.pids` and the resource-limits prose extended to include PID counts — docs are now in sync with the compose files.

_{Last reviewed commit: 770b7c0}

greptile-apps · 2026-03-15T12:14:37Z

cli/internal/compose/compose.yml.tmpl

        limits:
          memory: 4G
          cpus: "2.0"
+          pids: 256


Docs still reference pids_limit for CIS 5.28

docs/security.md (line 115) was not updated as part of this PR. It still documents the old key:

| **CIS 5.28** | `pids_limit` per container (256 backend, 64 web) |

It should be updated to reference the new deploy.resources.limits.pids field so the security documentation stays in sync with the actual compose files. The resource limits note on the line immediately below (line 117) also only mentions memory and CPU — pids could be added there too.

Prompt To Fix With AI

This is a comment left during a code review. Path: cli/internal/compose/compose.yml.tmpl Line: 35 Comment: **Docs still reference `pids_limit` for CIS 5.28** `docs/security.md` (line 115) was not updated as part of this PR. It still documents the old key: ``` | **CIS 5.28** | `pids_limit` per container (256 backend, 64 web) | ``` It should be updated to reference the new `deploy.resources.limits.pids` field so the security documentation stays in sync with the actual compose files. The resource limits note on the line immediately below (line 117) also only mentions memory and CPU — `pids` could be added there too. How can I resolve this? If you propose a fix, please make it concise.

🤖 I have created a release *beep* *boop* --- ## [0.2.4](v0.2.3...v0.2.4) (2026-03-15) ### Bug Fixes * attach cosign signatures and provenance bundle to release assets ([#438](#438)) ([f191a4d](f191a4d)) * create git tag explicitly for draft releases ([#432](#432)) ([1f5120e](1f5120e)) * docker healthcheck, CI optimization, and container hardening ([#436](#436)) ([4d32bca](4d32bca)) * ensure security headers on all HTTP responses ([#437](#437)) ([837f2fc](837f2fc)) * make install scripts usable immediately without terminal restart ([#433](#433)) ([b45533c](b45533c)) * migrate pids_limit to deploy.resources.limits.pids ([#439](#439)) ([66b94fd](66b94fd)) ### Refactoring * redesign release notes layout ([#434](#434)) ([239aaf7](239aaf7)) ### Maintenance * **site:** replace hero CTA with license link and scroll arrow ([#440](#440)) ([56af41c](56af41c)) * **web:** adopt @vue/tsconfig preset ([#435](#435)) ([7d4b214](7d4b214)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please).

🤖 I have created a release *beep* *boop* --- ## [0.2.4](v0.2.3...v0.2.4) (2026-03-15) ### Bug Fixes * attach cosign signatures and provenance bundle to release assets ([#438](#438)) ([f191a4d](f191a4d)) * create git tag explicitly for draft releases ([#432](#432)) ([1f5120e](1f5120e)) * docker healthcheck, CI optimization, and container hardening ([#436](#436)) ([4d32bca](4d32bca)) * ensure security headers on all HTTP responses ([#437](#437)) ([837f2fc](837f2fc)) * make install scripts usable immediately without terminal restart ([#433](#433)) ([b45533c](b45533c)) * migrate pids_limit to deploy.resources.limits.pids ([#439](#439)) ([66b94fd](66b94fd)) * use cosign --bundle flag for checksums signing ([#443](#443)) ([19735b9](19735b9)) ### Refactoring * redesign release notes layout ([#434](#434)) ([239aaf7](239aaf7)) ### Maintenance * **main:** release 0.2.4 ([#431](#431)) ([63b03c4](63b03c4)) * remove stale v0.2.4 changelog section from failed release ([#446](#446)) ([769de10](769de10)) * reset version to 0.2.3 for re-release ([#444](#444)) ([8579993](8579993)) * **site:** replace hero CTA with license link and scroll arrow ([#440](#440)) ([56af41c](56af41c)) * **web:** adopt @vue/tsconfig preset ([#435](#435)) ([7d4b214](7d4b214)) --- This PR was generated with [Release Please](https://github.com/googleapis/release-please). See [documentation](https://github.com/googleapis/release-please#release-please).

Aureliolo added 2 commits March 15, 2026 13:08

fix: migrate pids_limit to deploy.resources.limits.pids

7d8831a

Newer Docker Compose (v2.32+) rejects top-level `pids_limit` when `deploy.resources.limits` is also present, causing DAST CI failure. Move to the canonical `deploy.resources.limits.pids` location.

fix: migrate pids_limit in docker/compose.yml

b22abfd

Same pids_limit to deploy.resources.limits.pids migration for the development compose file (missed in previous commit).

gemini-code-assist bot reviewed Mar 15, 2026

View reviewed changes

greptile-apps bot reviewed Mar 15, 2026

View reviewed changes

docs: update security.md to reference deploy.resources.limits.pids

770b7c0

Aureliolo merged commit 66b94fd into main Mar 15, 2026
40 of 41 checks passed

Aureliolo deleted the fix/compose-pids-limit branch March 15, 2026 12:18

Aureliolo temporarily deployed to cloudflare-preview March 15, 2026 12:18 — with GitHub Actions Inactive

Aureliolo mentioned this pull request Mar 15, 2026

chore(main): release 0.2.4 #431

Merged

This was referenced Mar 15, 2026

chore(main): release 0.2.0 #442

Closed

chore(main): release 0.2.4 #445

Merged

This was referenced Mar 15, 2026

chore(main): release 0.2.5 #447

Merged

chore(main): release 0.2.0 #460

Closed

chore(main): release 0.2.0 #471

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix: migrate pids_limit to deploy.resources.limits.pids#439

fix: migrate pids_limit to deploy.resources.limits.pids#439
Aureliolo merged 3 commits intomainfrom
fix/compose-pids-limit

Aureliolo commented Mar 15, 2026

Uh oh!

github-actions bot commented Mar 15, 2026 •

edited

Loading

Uh oh!

gemini-code-assist bot commented Mar 15, 2026

Uh oh!

coderabbitai bot commented Mar 15, 2026 •

edited

Loading

Review failed

Summary by CodeRabbit

Walkthrough

Changes

Estimated code review effort

Uh oh!

gemini-code-assist bot left a comment

Uh oh!

greptile-apps bot commented Mar 15, 2026 •

edited

Loading

Uh oh!

greptile-apps bot Mar 15, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

Aureliolo commented Mar 15, 2026

Summary

Test plan

Review coverage

Uh oh!

github-actions bot commented Mar 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Dependency Review

Scanned Files

Uh oh!

gemini-code-assist bot commented Mar 15, 2026

Summary of Changes

Highlights

Footnotes

Uh oh!

coderabbitai bot commented Mar 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review failed

Summary by CodeRabbit

Walkthrough

Changes

Estimated code review effort

Uh oh!

gemini-code-assist bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

greptile-apps bot commented Mar 15, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Greptile Summary

Confidence Score: 5/5

Important Files Changed

Uh oh!

greptile-apps bot Mar 15, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

github-actions bot commented Mar 15, 2026 •

edited

Loading

coderabbitai bot commented Mar 15, 2026 •

edited

Loading

greptile-apps bot commented Mar 15, 2026 •

edited

Loading