Restore strict overlay limit semantics

Author: sjmiller609

lib/instances/manager.go

@@ -74,7 +74,7 @@ type ImageUsageRecorderSetter interface {
 
 // ResourceLimits contains configurable resource limits for instances
 type ResourceLimits struct {
-	MaxOverlaySize       int64 // Maximum overlay disk size in bytes per instance (0 = unlimited)
+	MaxOverlaySize       int64 // Maximum overlay disk size in bytes per instance
 	MaxVcpusPerInstance  int   // Maximum vCPUs per instance (0 = unlimited)
 	MaxMemoryPerInstance int64 // Maximum memory in bytes per instance (0 = unlimited)
 	NamePatterns         []NamedResourceLimit

lib/instances/name_limits.go

@@ -97,7 +97,7 @@ func (l ResourceLimits) ForName(name string) ResourceLimits {
 func validateResourceLimitsForName(name string, limits ResourceLimits, overlaySize int64, vcpus int, totalMemory int64) error {
 	effective := limits.ForName(name)
 
-	if effective.MaxOverlaySize > 0 && overlaySize > effective.MaxOverlaySize {
+	if overlaySize > effective.MaxOverlaySize {
 		return fmt.Errorf("overlay size %d exceeds maximum allowed size %d", overlaySize, effective.MaxOverlaySize)
 	}
 	if effective.MaxVcpusPerInstance > 0 && vcpus > effective.MaxVcpusPerInstance {

lib/instances/name_limits_test.go

@@ -64,15 +64,14 @@ func TestResourceLimitsForName_FallsBackWhenFieldOmitted(t *testing.T) {
 	assert.Equal(t, int64(32*1024*1024*1024), resolved.MaxMemoryPerInstance)
 }
 
-func TestValidateResourceLimitsForName_ZeroOverrideMeansUnlimited(t *testing.T) {
+func TestValidateResourceLimitsForName_ZeroCpuAndMemoryOverrideMeansUnlimited(t *testing.T) {
 	t.Parallel()
 
 	zeroInt := 0
 	zeroBytes := int64(0)
 	override, err := NewNamedResourceLimit("^burst-.*", NamedResourceLimitConfig{
 		MaxVcpusPerInstance:  &zeroInt,
 		MaxMemoryPerInstance: &zeroBytes,
-		MaxOverlaySize:       &zeroBytes,
 	})
 	require.NoError(t, err)
 
@@ -87,6 +86,27 @@ func TestValidateResourceLimitsForName_ZeroOverrideMeansUnlimited(t *testing.T)
 	require.NoError(t, err)
 }
 
+func TestValidateResourceLimitsForName_ZeroOverlayOverrideRejectsPositiveOverlay(t *testing.T) {
+	t.Parallel()
+
+	zeroBytes := int64(0)
+	override, err := NewNamedResourceLimit("^burst-.*", NamedResourceLimitConfig{
+		MaxOverlaySize: &zeroBytes,
+	})
+	require.NoError(t, err)
+
+	limits := ResourceLimits{
+		MaxOverlaySize:       5 * 1024 * 1024 * 1024,
+		MaxVcpusPerInstance:  2,
+		MaxMemoryPerInstance: 4 * 1024 * 1024 * 1024,
+		NamePatterns:         []NamedResourceLimit{override},
+	}
+
+	err = validateResourceLimitsForName("burst-worker", limits, 1, 2, 4*1024*1024*1024)
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "overlay size 1 exceeds maximum allowed size 0")
+}
+
 func TestValidateResourceLimitsForName_RejectsWhenResolvedLimitExceeded(t *testing.T) {
 	t.Parallel()
 
@@ -108,6 +128,27 @@ func TestValidateResourceLimitsForName_RejectsWhenResolvedLimitExceeded(t *testi
 	assert.Contains(t, err.Error(), "vcpus 8 exceeds maximum allowed 4 per instance")
 }
 
+func TestValidateResourceLimitsForName_GlobalOverlayLimitAppliesWhenNoPatternMatches(t *testing.T) {
+	t.Parallel()
+
+	four := 4
+	override, err := NewNamedResourceLimit("^db-.*", NamedResourceLimitConfig{
+		MaxVcpusPerInstance: &four,
+	})
+	require.NoError(t, err)
+
+	limits := ResourceLimits{
+		MaxOverlaySize:       10 * 1024 * 1024 * 1024,
+		MaxVcpusPerInstance:  16,
+		MaxMemoryPerInstance: 64 * 1024 * 1024 * 1024,
+		NamePatterns:         []NamedResourceLimit{override},
+	}
+
+	err = validateResourceLimitsForName("cache-primary", limits, 20*1024*1024*1024, 8, 16*1024*1024*1024)
+	require.Error(t, err)
+	assert.Contains(t, err.Error(), "overlay size 21474836480 exceeds maximum allowed size 10737418240")
+}
+
 func TestValidateProvisionedResourceLimitsForName_RejectsProjectedTotal(t *testing.T) {
 	t.Parallel()