- Shipped
- August 11, 2026 at 4:20 PM UTC
- Author
- Kamo
- Commit
- ae5b567
Chat attachments have run at 3 GiB through this same imaging pipeline for a while; documents were capped at 500MB. The difference was not a policy, it was that this path buffered and the chat path streamed, and a user experiences it as "chat takes my video but the document library does not". Four things had to move together, because raising one alone accomplishes nothing: 1. Ingest now calls **************** and hands over the MultipartFile as a re-openable source. file-size-threshold: 0B makes Tomcat spool every part to disk so each getInputStream() re-opens the spool file. The buffered overload allocated new byte[size] twice — once to hash, once for MinIO's retry copy. 2. Post-upload conversion no longer pulls the object into heap for video. It streams from MinIO to a scratch file and hands ffmpeg the path (new extractPosterFrame(Path) and probeDurationMs(Path) overloads). A byte[] cannot hold a 3 GiB video at all, and the round trip through heap was pointless anyway — the byte[] form wrote a temp file regardless. 3. Everything else is guarded by HEAP_CONVERSION_MAX_BYTES (256 MiB). Conversion holds the original, the converted PDF and every rendered thumbnail at once; above the ceiling the file is stored, downloadable and streamable but gets no rendition, with the reason recorded on the dat so the UI can say so instead of spinning forever. An OOMKill here is not local — it takes conversion down for every tenant on the node. 4. multipart 3GB/3100MB with an explicit spool location, plus a bounded 24Gi emptyDir mounted at /tmp/kamo-uploads for both the spool and the video scratch copy, so a stuck or hostile upload cannot grow the image layer or fill the node's disk. The byte[] video poster helper had no callers left and was removed rather than left behind. Note: **************** fails on a workstation with ffmpeg 8.x (it encodes WebP where the test expects PNG passthrough). Pre-existing and environment-dependent — neither that service nor its test is touched here.