backend/tests/test_rc6_supply_chain.py

@@ -123,6 +123,8 @@ def test_scanner_images_are_versioned_and_digest_pinned() -> None:
     assert 'docker save "$IMAGE_ID"' in sbom
     assert '"docker-archive:$WORKDIR/$IMAGE_ARCHIVE"' in sbom
     assert 'SYFT_PARALLELISM=${SYFT_PARALLELISM:-1}' in sbom
+    assert 'GOMEMLIMIT=${SYFT_GOMEMLIMIT:-4GiB}' in sbom
+    assert 'GOGC=${SYFT_GOGC:-25}' in sbom
     assert "--select-catalogers=-binary" in sbom
     assert '--volumes-from "$HOSTNAME"' in sbom
     assert 'ARCHIVE_ID_FILE="${IMAGE_ARCHIVE}.image-id"' in sbom

scripts/generate_container_sbom.sh

@@ -57,13 +57,16 @@ if [[ -n "${HOSTNAME:-}" ]] && docker inspect --type container "$HOSTNAME" >/dev
   WORKSPACE_ARGS=(--volumes-from "$HOSTNAME")
 fi
 
-# CUDA and PyTorch ship several gigabytes of native binaries. Syft's heuristic
-# binary catalogers exceed the isolated runner's 8 GiB limit on that content.
-# Authoritative dpkg, Python, npm and other installed-package catalogers remain
-# enabled; Trivy still scans the complete immutable archive independently.
+# CUDA and PyTorch ship several gigabytes of native binaries. Keep Syft's Go
+# heap below the isolated runner's 8 GiB limit and collect garbage proactively;
+# otherwise the Docker-in-Docker job can be OOM-killed even with one cataloger
+# worker. Authoritative dpkg, Python, npm and other installed-package catalogers
+# remain enabled; Trivy still scans the complete immutable archive independently.
 docker run --rm \
   --user 0:0 \
   -e "SYFT_PARALLELISM=${SYFT_PARALLELISM:-1}" \
+  -e "GOMEMLIMIT=${SYFT_GOMEMLIMIT:-4GiB}" \
+  -e "GOGC=${SYFT_GOGC:-25}" \
   "${WORKSPACE_ARGS[@]}" \
   -w "$WORKDIR" \
   "$SYFT_IMAGE" \