From 4aafd32b4a513daacfb3601d27c31c24841d8598 Mon Sep 17 00:00:00 2001 From: Niek Otten Date: Mon, 27 Jul 2026 16:10:49 +0200 Subject: [PATCH] =?UTF-8?q?perf(infra):=20cap=20OpenZaak=20+=20NRC=20uWSGI?= =?UTF-8?q?=20to=201=20worker=20=E2=80=94=20shrink=20verify-stack=20footpr?= =?UTF-8?q?int=20(closes=20#147)?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Follow-up to #145. OpenZaak and NRC (nrc-web) are Maykin/vng uWSGI images running the image default of 4 processes × 4 threads — ~4 full-Django worker processes (~800 MB) each, idle, on the single shared runner. As the stack grew to 37 services this pressure made verify-stack struggle. Set UWSGI_PROCESSES=1 + UWSGI_THREADS=2 on the &oz-env / &nrc-env anchors in both compose files. These APIs serve single-request smoke checks and are not load-tested, so 1 worker suffices; ~1.2 GB freed. The anchors are shared with the -init (setup_configuration) and -celery containers, which ignore the var (they don't run uwsgi). Verified locally: OpenZaak healthy with the cap, uwsgi processes 6→3, admin still 302. docker compose config clean on both files. Co-Authored-By: Claude Opus 4.8 (1M context) --- infra/docker-compose.local.yml | 7 +++++++ infra/docker-compose.yml | 9 +++++++++ 2 files changed, 16 insertions(+) diff --git a/infra/docker-compose.local.yml b/infra/docker-compose.local.yml index a148115..cef59b0 100644 --- a/infra/docker-compose.local.yml +++ b/infra/docker-compose.local.yml @@ -56,6 +56,10 @@ services: oz-init: image: docker.io/openzaak/open-zaak:${OPENZAAK_TAG:-1.28.2} environment: &oz-env + # 1 uWSGI worker, not the image default of 4×4 (#147) — idle workers pressure the runner; the + # -init/-celery containers share this anchor and ignore it (they don't run uwsgi). + UWSGI_PROCESSES: "1" + UWSGI_THREADS: "2" DJANGO_SETTINGS_MODULE: openzaak.conf.docker SECRET_KEY: ${OZ_SECRET_KEY:-dev-only-not-for-production} DB_HOST: oz-db @@ -138,6 +142,9 @@ services: # bind-mounted here (this twin is the local/no-make path). See ADR-0007. image: docker.io/openzaak/open-notificaties:${OPENNOTIFICATIES_TAG:-1.16.1} environment: &nrc-env + # 1 uWSGI worker, not the image default of 4×4 (#147) — see the oz-env note above. + UWSGI_PROCESSES: "1" + UWSGI_THREADS: "2" DJANGO_SETTINGS_MODULE: nrc.conf.docker SECRET_KEY: ${NRC_SECRET_KEY:-dev-only-not-for-production} DB_HOST: nrc-db diff --git a/infra/docker-compose.yml b/infra/docker-compose.yml index c7a1fde..ee5d0aa 100644 --- a/infra/docker-compose.yml +++ b/infra/docker-compose.yml @@ -51,6 +51,12 @@ services: oz-init: image: docker.io/openzaak/open-zaak:${OPENZAAK_TAG:-1.28.2} environment: &oz-env + # 1 uWSGI worker, not the image default of 4×4 (#147, same lever as #145): OpenZaak serves + # single-request smoke checks here and is not load-tested, so 4 idle Django workers just pin + # ~800 MB and pressure the shared runner. The -init (setup_configuration) and -celery containers + # share this anchor and ignore it — they don't run uwsgi. + UWSGI_PROCESSES: "1" + UWSGI_THREADS: "2" DJANGO_SETTINGS_MODULE: openzaak.conf.docker SECRET_KEY: ${OZ_SECRET_KEY:-dev-only-not-for-production} DB_HOST: oz-db @@ -135,6 +141,9 @@ services: # needs no baked config. image: docker.io/openzaak/open-notificaties:${OPENNOTIFICATIES_TAG:-1.16.1} environment: &nrc-env + # 1 uWSGI worker, not the image default of 4×4 (#147) — see the oz-env note above. + UWSGI_PROCESSES: "1" + UWSGI_THREADS: "2" DJANGO_SETTINGS_MODULE: nrc.conf.docker SECRET_KEY: ${NRC_SECRET_KEY:-dev-only-not-for-production} DB_HOST: nrc-db -- 2.54.0