Swap covers memory pressure. These are its neighbours:
8. Emergency disk ballast the same valve, for disk
9. earlyoom what happens when swap runs out too
10. inotify watch limit the silent one
All three follow the rule this script now works to: the role sets which way the
recommendation points, never whether the question is asked. A dev machine is
still offered the ballast, with the recommendation pointing the other way; a
server is still offered the inotify raise, because anything running `bun --watch`
or serving a file browser is a watcher too.
The ballast is section 22 of the original, moved up beside swap where it belongs
and moved out of the user's home. The original wrote the checker into
$USER_HOME/.local/bin and ran it from a root cron — a root cron executing a
script in a directory its owner can write is a privilege escalation waiting to be
noticed. Moot on a box where that user already has passwordless sudo, but wrong.
Both the checker and the file are in root-owned system paths now.
Two bugs found by running the generated checker rather than reading it:
It df'd the ballast's own directory, which does not exist before the ballast is
created — and with `set -euo pipefail` that meant cron mailing an error every
ten minutes. It now walks up to a directory that exists, and the installer
creates the directory itself rather than depending on the create step.
The inotify text claimed a default of 8192. This host is at 29461: Ubuntu
raised it, and stating a number the reader can see is wrong on their own screen
undermines the rest of the explanation. It now describes the failure instead
and prints the machine's actual value.
earlyoom is a distro package and a systemd unit, so it is checked with
`systemctl is-active` and reports honestly when it installs but fails to start.
Verified: checker --status and its no-op path both exit 0 with no directory
present, and the helpers report correctly against this host.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
pastilhasandClaude Opus 5
9b0e05bfd8