Let systemd-oomd kill a runaway app instead of losing the session (#6445)

Nothing stood between "memory is tight" and "processes die at random": the kernel OOM killer only fires after an allocation has already failed, so a machine under pressure thrashes in reclaim until something breaks somewhere fatal — seen in practice as Hyprland taking SIGBUS mid-memcpy from a client shm pool that memory pressure was tearing down. Enable systemd-oomd, which keys on PSI stall time rather than free pages, and mark app.slice — and only app.slice — as its kill candidate. Hyprland runs in session.slice, so the compositor is structurally ineligible as a victim: oomd takes the app that caused the pressure and the session survives. Thresholds (50% stall over 20s, Fedora's desktop defaults) live in an oomd.conf.d drop-in; candidacy ships as a vendor drop-in under /usr/lib/systemd/user so existing users get it on package upgrade with no per-user seeding. New installs enable the daemon from enable-services.sh; a migration covers existing ones, restarting an already-running oomd so it doesn't keep stale thresholds until reboot. Deliberately not earlyoom: it triggers only when free RAM and free swap are both under threshold, so Omarchy's large, mostly-idle swapfiles keep it asleep through exactly this failure. Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
2026-07-31 15:16:29 -04:00
parent 5844e02d2e
commit 1ea910f662
6 changed files with 104 additions and 0 deletions
@@ -0,0 +1,21 @@
+# Without an OOM daemon there is nothing between "memory is tight" and
+# "processes start dying at random". The kernel OOM killer only fires once an
+# allocation has already failed outright, which is far too late for the
+# desktop: the machine thrashes in reclaim until something fails somewhere
+# fatal. Seen in practice as Hyprland taking SIGBUS mid-memcpy from a Wayland
+# client's shm pool, because the client was being torn down by the same memory
+# pressure. One app misbehaving should not cost the whole session.
+#
+# systemd-oomd keys on PSI stall time rather than on free pages, so it acts
+# while the machine is still thrashing instead of after an allocation failed.
+# Deliberately not earlyoom: that fires only when free RAM *and* free swap are
+# both under threshold, so a large, mostly-unused swapfile keeps it asleep
+# through exactly this failure.
+#
+# 50% means half of a ten-second window was spent stalled on memory reclaim.
+# Held for 20s straight, the desktop is already unusable and losing one app is
+# the cheaper outcome. Which cgroups are eligible is set separately, in
+# /usr/lib/systemd/user/app.slice.d/10-oomd.conf.
+[OOM]
+DefaultMemoryPressureDurationSec=20s
+DefaultMemoryPressureLimit=50%