Cap the site backend's resources and document manual record lookups

docker-compose.staging.yml

@@ -26,6 +26,10 @@ services:
         condition: service_healthy
     security_opt:
       - no-new-privileges:true
+    # Caps a runaway process, such as a stray `docker exec` command; normal use is about 5 GB and one core.
+    cpus: 4
+    mem_limit: 12g
+    pids_limit: 1024
     restart: unless-stopped
 
   db:

docker-compose.yml

@@ -21,6 +21,10 @@ services:
         condition: service_healthy
     security_opt:
       - no-new-privileges:true
+    # Caps a runaway process, such as a stray `docker exec` command; normal use is about 5 GB and one core.
+    cpus: 4
+    mem_limit: 12g
+    pids_limit: 1024
     restart: always
 
   # The site's Postgres (site records, Precedent and patch notes). backend/.env sets

docs/docs/ops/postgresql.md

@@ -33,6 +33,21 @@ PostgreSQL types; timestamp serialization and public JSON formats stay compatibl
 settings bound queries and locks. Domain advisory locks coordinate checks that span multiple rows or the
 absence of a row; file guards coordinate wardrobe and map assets across workers.
 
+### Looking up records by hand
+
+Site records such as `discord_links` are only in PostgreSQL. There is no live `province.db`; the
+`province*.db` files under `src/data/` are stale backups from before the move to PostgreSQL, so don't
+search the container's filesystem for a database. A recursive search from `/`, such as Python's
+`glob('/**/…', recursive=True)`, follows the looping symlinks under `/sys` and never finishes. Query the
+site's `db` service instead, with read-only SQL:
+
+```bash
+sudo -n -u tfmc /usr/local/sbin/ps-compose main exec -T db psql -U provincesystem -d provincesystem \
+  -c "select * from discord_links where lower(discord_username) like '%name%'"
+```
+
+Use `dev` instead of `main` for the Dev site.
+
 An hourly housekeeping loop in the backend, which also runs at startup, clears data that has outlived its use.
 It clears the plaintext of login codes that expired unused and deletes expired code sessions
 ([opaque Bearer sessions](../identity/auth-security.md#opaque-bearer-sessions)).