- Shipped
- September 5, 2026 at 3:05 PM UTC
- Author
- Kamo
- Commit
- 7811cbd
libretranslate ran 4 gunicorn workers against a 12Gi limit, and each worker loads its own ~3GB copy of the argos model set — 11.8GB resident, 98% of the limit, permanently. The kernel then reclaimed the mmapped model pages to stay under it, so every request to an evicted pair paid a cold load from disk. Measured on the live pod: en->es 0.045s warm vs 3.76s cold; en->ru 0.004s warm vs 9.64s cold. A knowledge-base article is a batch of those, which is why en->ru exceeded the provider's 90s timeout on every attempt and left ten articles permanently untranslated while pinning both replicas at ~8 cores for days. The workers were not translating, they were re-reading models. Two workers per pod across two pods is the same four workers we effectively had, each now with room to keep its models resident. Memory is requested at what the models actually occupy rather than a fraction of it. Also refuses 213.111.158.207 at the edge, which spent 21 minutes walking a backup-archive wordlist against internal.madagascarcapital.com. Traefik v3.3 has no deny-list middleware, so this uses the ClientIP router matcher at a priority above every host route, pointed at an ipAllowList that permits only RFC 5737 TEST-NET-1 and therefore refuses everything. A Cilium ingressDeny would also work but selects the pods that carry every tenant's ingress, where a mistake is the whole edge rather than one address. The rate limit goes 100/s to 60/s sustained. Stated plainly in the manifest: this is NOT what stops that scanner and no setting of it would have been — it ran at 0.8 rps. The scanner was expensive per request, not frequent, and that is fixed in kamo-internal's proxy.