limit cpu on docker deploy

Author: michaelwschultz

.github/workflows/deploy.yml

@@ -74,8 +74,10 @@ jobs:
           script: |
             set -euo pipefail
             cd "${{ secrets.DEPLOY_APP_DIR }}"
-            git fetch origin main
-            git checkout main
-            git pull --ff-only origin main
+            echo "→ Syncing main"
+            git fetch -q origin main
+            git checkout -q main
+            git pull -q --ff-only origin main
+            echo "✓ At $(git rev-parse --short HEAD)"
             ./deploy/write-env.sh
             ./deploy/deploy.sh

AGENTS.md

@@ -5,18 +5,17 @@
 - Keep the work page intro prominent; list past tech roles in a minimal, de-emphasized way with no company logos.
 - Avoid implicit `any`; type route `+page.ts` loaders with `PageLoad` from `./$types`.
 - Keep thoughts as local markdown on disk; syndicate to the ATmosphere with standard.site, do not render posts from the PDS.
+- Use `@lucide/svelte` for UI icons; keep GitHub and Bluesky brand logos in `BrandIcon` (Lucide excludes brand icons).
 
 ## Learned Workspace Facts
 
-- SvelteKit site at the repo root: `@sveltejs/adapter-node` (hybrid — most routes prerendered, `/listening` is SSR), `$lib/content/*` plus `$lib/config/*` for posts, work, games, and site config. Thoughts are local markdown (`src/content/thoughts/*.md`, `markdown-it`, `js-yaml` v3 frontmatter); syndicate to standard.site via `@ewanc26/svelte-standard-site` (`pnpm publish-publication`, `publish-thought`, `publish-thoughts`, `write-well-known`; markpub.at content). Verification `<link>` tags on individual thought pages only; `pnpm-workspace.yaml` pins `@ewanc26/*` overrides.
+- SvelteKit site at the repo root: `@sveltejs/adapter-node` (hybrid — most routes prerendered; Node server required for `/listening`, `/api/status`, `/api/cron/sync-listening`, and `hooks.server.ts` SQLite/cron — not removable without architecture change), `$lib/content/*` plus `$lib/config/*` for posts, work, games, and site config. Thoughts are local markdown (`src/content/thoughts/*.md`, `markdown-it`, `js-yaml` v3 frontmatter); syndicate to standard.site via `@ewanc26/svelte-standard-site` (`pnpm publish-publication`, `publish-thought`, `publish-thoughts`, `write-well-known`; markpub.at content). Verification `<link>` tags on individual thought pages only; `pnpm-workspace.yaml` pins `@ewanc26/*` overrides.
 - `/listening` reads recent Last.fm scrobbles from SQLite (`better-sqlite3`); sync runs via in-process `node-cron` (~5×/day at server startup) and stale refresh on page load; `GET /api/cron/sync-listening` (Bearer `CRON_SECRET`) is optional for external/manual HTTP sync only.
 - Homepage status line reads `com.michaelschultz.status/self` from Bluesky via `/api/status` (60s server cache); publish with `pnpm status` using `BLUESKY_APP_PASSWORD` locally (not needed at runtime).
-- Docker deployment: multi-stage `Dockerfile` + `docker-compose.yml` on external network `pangolin` for reverse-proxy routing; shared pnpm store cache mount with separate `prod-deps` and `build` stages (runtime copies prod `node_modules` from `prod-deps`, `build/` from `build`); `pnpm-workspace.yaml` sets `trustLockfile: true`; production image is built in GitHub Actions and pushed to `ghcr.io/michaelwschultz/michaelschultz.com`; VPS runs `deploy/deploy.sh` (`docker compose pull` + `up --no-build`); SQLite at `DATABASE_PATH` (default `/app/data/listening.db`); `deploy/docker-entrypoint.sh` chowns the `listening-data` volume.
-- Production deploy is automated via `.github/workflows/deploy.yml` (GH Actions build/push to GHCR, then SSH pull + `deploy/write-env.sh` + `deploy/deploy.sh`); app and infrastructure settings live in GitHub Environment secrets, not in the repo.
+- Docker deployment: multi-stage `Dockerfile` + `docker-compose.yml` on external network `pangolin` for reverse-proxy routing; shared pnpm store cache mount with separate `prod-deps` and `build` stages (runtime copies prod `node_modules` from `prod-deps`, `build/` from `build`); `pnpm-workspace.yaml` sets `trustLockfile: true`; production image is built in GitHub Actions (`.github/workflows/deploy.yml`) and pushed to `ghcr.io/michaelwschultz/michaelschultz.com`; VPS runs `deploy/deploy.sh` (`docker compose pull` + `up --no-build`, no on-host build); do not pass `--config.child-concurrency=2` to `pnpm install` in the Dockerfile (pnpm 11 lifecycle-hook bug); SQLite at `DATABASE_PATH` (default `/app/data/listening.db`); `deploy/docker-entrypoint.sh` chowns the `listening-data` volume; app and infrastructure settings live in GitHub Environment secrets, not in the repo.
+- Thought read-aloud: client-side Kokoro TTS (`kokoro-js`) on `/thoughts/[slug]/` only; engine in `$lib/page-reader/*` (ported from standard-reader); `thoughts/[slug]/+layout.svelte` lazy-loads the engine and `PageReaderBar`; attributes standard-reader.app; word highlighting via CSS `::highlight(reader-word)` in `static/reader-highlight.css` (outside Tailwind pipeline).
 - Static assets live under `static/static/` so URLs stay `/static/images/...`.
-- Search is Pagefind: `pnpm build` runs `vite build` then `scripts/postbuild.mjs` to index `build/`; UI uses the `pagefind-modal` web component; dev search needs a production build (index not available in `vite dev`).
-- `export const trailingSlash = 'always'` in `src/routes/+layout.ts` emits directory-style HTML (`work/index.html`) for correct Pagefind paths.
-- Layout sets `data-pagefind-meta` with clean route URLs (e.g. `url:/work`); `content-check` routes use `data-pagefind-ignore` so they are not indexed.
+- Search is Pagefind: `pnpm build` runs `vite build` then `scripts/postbuild.mjs` to index `build/`; UI uses the `pagefind-modal` web component; dev search needs a production build (index not available in `vite dev`); `export const trailingSlash = 'always'` in `src/routes/+layout.ts` emits directory-style HTML for correct paths; layout sets `data-pagefind-meta` with clean route URLs (e.g. `url:/work`); `content-check` routes use `data-pagefind-ignore` so they are not indexed.
 - Node is locked to 24.x (`engines` in `package.json`, `.nvmrc`, `.node-version`).
 - Open Graph and Twitter meta come from `SocialMeta` in the root layout and `getPageSocialMeta` in `$lib/utils/social-meta.ts`; default image is `site.socialBanner` (`/static/images/michael-schultz-social.jpg`).
 - `pnpm check` runs `svelte-check` then `tsc --noEmit` so untyped route loaders are caught in CI and locally.

deploy/deploy.sh

@@ -6,9 +6,47 @@ cd "$ROOT_DIR"
 
 export WEB_IMAGE="${WEB_IMAGE:-ghcr.io/michaelwschultz/michaelschultz.com:latest}"
 
+# Cap dockerd during pull/up (layer extract runs in the daemon, not the compose CLI).
+# On a 1-vCPU host, 80% keeps headroom for SSH/system. On N vCPUs use N×80% (e.g. 160%).
+DEPLOY_DOCKER_CPU_QUOTA="${DEPLOY_DOCKER_CPU_QUOTA:-80%}"
+docker_cpu_limited=0
+
+reset_docker_cpu_quota() {
+	if [[ "$docker_cpu_limited" -eq 1 ]]; then
+		systemctl set-property docker.service --reset-property=CPUQuota 2>/dev/null \
+			|| sudo -n systemctl set-property docker.service --reset-property=CPUQuota 2>/dev/null \
+			|| true
+		docker_cpu_limited=0
+	fi
+}
+
+limit_docker_cpu_quota() {
+	if [[ -z "$DEPLOY_DOCKER_CPU_QUOTA" ]]; then
+		return 0
+	fi
+	if systemctl set-property docker.service "CPUQuota=${DEPLOY_DOCKER_CPU_QUOTA}" 2>/dev/null \
+		|| sudo -n systemctl set-property docker.service "CPUQuota=${DEPLOY_DOCKER_CPU_QUOTA}" 2>/dev/null; then
+		docker_cpu_limited=1
+		echo "→ Docker daemon CPU capped at ${DEPLOY_DOCKER_CPU_QUOTA} for deploy"
+	fi
+}
+
+trap reset_docker_cpu_quota EXIT
+
 if [[ -n "${GHCR_TOKEN:-}" && -n "${GHCR_USERNAME:-}" ]]; then
-	echo "$GHCR_TOKEN" | docker login ghcr.io -u "$GHCR_USERNAME" --password-stdin
+	echo "$GHCR_TOKEN" | docker login ghcr.io -u "$GHCR_USERNAME" --password-stdin >/dev/null
 fi
 
-docker compose pull web
+limit_docker_cpu_quota
+
+echo "→ Pulling ${WEB_IMAGE}"
+docker compose pull --quiet web
+image_id="$(docker image inspect "$WEB_IMAGE" --format '{{.Id}}')"
+echo "✓ Image ready (${image_id})"
+
 docker compose up -d --no-build
+container_id="$(docker compose ps -q web)"
+echo "✓ web running (${container_id})"
+
+reset_docker_cpu_quota
+trap - EXIT

docker-compose.yml

@@ -2,6 +2,7 @@ services:
   web:
     image: ${WEB_IMAGE:-michaelschultzcom-web}
     build: .
+    cpus: 0.8
     restart: unless-stopped
     volumes:
       - listening-data:/app/data