puppet: Use memory limits from cgroup, if set.

This fixes behaviour where a Docker image with a memory limit would
immediately OOM, as it would not detect the container's memory limit,
only the host's.

Fixes: #29794
(cherry picked from commit c75535a154)

docs/overview/changelog.md

@@ -10,6 +10,13 @@ lifecycle](../overview/release-lifecycle.md).
 
 ## Zulip Server 11.x series
 
+### Zulip Server 11.4
+
+_Released 2025-10-23_
+
+- Fixed a bug that could cause the incoming email server to crash on
+  startup.
+
 ### Zulip Server 11.3
 
 _Released 2025-10-22_

puppet/zulip/lib/facter/container_memory_limit.rb

@@ -0,0 +1,25 @@
+Facter.add(:container_memory_limit_mb) do
+  confine kernel: 'Linux'
+
+  setcode do
+    begin
+      memory_limit_mb = nil
+
+      # Check for cgroup v2
+      if File.exist?('/sys/fs/cgroup/memory.max')
+        val = File.read('/sys/fs/cgroup/memory.max').strip
+        memory_limit_mb = val.to_i / 1024 / 1024 unless val == 'max'
+
+      # Fallback to cgroup v1
+      elsif File.exist?('/sys/fs/cgroup/memory/memory.limit_in_bytes')
+        val = File.read('/sys/fs/cgroup/memory/memory.limit_in_bytes').strip.to_i
+        memory_limit_mb = val / 1024 / 1024 if val < 9223372036854771712
+      end
+
+      memory_limit_mb
+    rescue => e
+      Facter.debug("container_memory_limit_mb error: #{e}")
+      nil
+    end
+  end
+end

puppet/zulip/manifests/common.pp

@@ -39,8 +39,11 @@ class zulip::common {
   }
   $supervisor_conf_dir = "${supervisor_system_conf_dir}/zulip"
 
-  $total_memory_bytes = $facts['memory']['system']['total_bytes']
+  if $facts['container_memory_limit_mb'] {
-  $total_memory_mb = $total_memory_bytes / 1024 / 1024
+    $total_memory_mb = Integer($facts['container_memory_limit_mb'])
+  } else {
+    $total_memory_mb = Integer($facts['memory']['system']['total_bytes'] / 1024 / 1024)
+  }
 
   $goarch = $facts['os']['architecture'] ? {
     'amd64'   => 'amd64',

version.py

@@ -1,6 +1,6 @@
 import os
 
-ZULIP_VERSION = "11.3"
+ZULIP_VERSION = "11.4+git"
 
 # Add information on number of commits and commit hash to version, if available
 zulip_git_version_file = os.path.join(
@@ -14,7 +14,7 @@ ZULIP_VERSION = lines.pop(0).strip()
 ZULIP_MERGE_BASE = lines.pop(0).strip()
 
 LATEST_MAJOR_VERSION = "11.0"
-LATEST_RELEASE_VERSION = "11.3"
+LATEST_RELEASE_VERSION = "11.4"
 LATEST_RELEASE_ANNOUNCEMENT = "https://blog.zulip.com/zulip-server-11-0"
 
 # Versions of the desktop app below DESKTOP_MINIMUM_VERSION will be

zerver/lib/email_mirror_server.py

@@ -177,7 +177,7 @@ class PermissionDroppingUnthreadedController(UnthreadedController):  # nocoverag
             # We may have a logfile owned by root, from before we
             # fixed it to be owned by zulip; chown it if it exists, so
             # we don't fail below.
-            if os.path.exists(settings.EMAIL_LOG_PATH):
+            if os.path.exists(settings.EMAIL_MIRROR_LOG_PATH):
                 os.chown(settings.EMAIL_MIRROR_LOG_PATH, self.user_id, self.group_id)
 
             logger.info("Dropping privileges to uid %d / gid %d", self.user_id, self.group_id)