test: add container-based OOM proof test

Run s3proxy in a 128MB memory-constrained container and hammer it with
concurrent large uploads. If the memory limiter fails, the kernel
OOM-kills the process (exit code 137) — a binary pass/fail.

- Add s3proxy service to docker-compose with mem_limit=128m (oom profile)
- Add test_memory_leak.py with PUT and multipart upload stress tests
- Add make test-oom target and CI step

Author: ServerSideHannes

.github/workflows/test.yml

@@ -13,7 +13,7 @@ on:
 jobs:
   tests:
     runs-on: ubuntu-latest
-    timeout-minutes: 15
+    timeout-minutes: 30
     steps:
       - uses: actions/checkout@v6
 
@@ -31,3 +31,6 @@ jobs:
 
       - name: Run all tests
         run: make test-all
+
+      - name: OOM proof test (128MB container)
+        run: make test-oom

Makefile

@@ -1,4 +1,4 @@
-.PHONY: test test-all test-unit test-run test-memory-bounds e2e cluster lint
+.PHONY: test test-all test-unit test-run test-oom e2e cluster lint
 
 # Lint: ruff check + format check
 lint:
@@ -33,6 +33,17 @@ test-run:
 		docker compose -f tests/docker-compose.yml down; \
 		exit $$EXIT_CODE
 
+# OOM proof test: runs s3proxy in a 128MB container and hammers it
+test-oom:
+	@docker compose -f tests/docker-compose.yml --profile oom down 2>/dev/null || true
+	@docker compose -f tests/docker-compose.yml --profile oom up -d --build
+	@sleep 5
+	@AWS_ACCESS_KEY_ID=minioadmin AWS_SECRET_ACCESS_KEY=minioadmin \
+		uv run pytest -v tests/integration/test_memory_leak.py; \
+		EXIT_CODE=$$?; \
+		docker compose -f tests/docker-compose.yml --profile oom down; \
+		exit $$EXIT_CODE
+
 # E2E cluster commands
 e2e:
 	./e2e/cluster.sh $(filter-out $@,$(MAKECMDGOALS))

tests/docker-compose.yml

@@ -15,3 +15,23 @@ services:
       MINIO_ROOT_USER: minioadmin
       MINIO_ROOT_PASSWORD: minioadmin
     command: server /data --console-address ":9001"
+
+  s3proxy:
+    profiles: ["oom"]
+    build:
+      context: ../
+      dockerfile: Dockerfile
+    container_name: s3proxy-test-server
+    mem_limit: 128m
+    ports:
+      - "4433:4433"
+    environment:
+      S3PROXY_ENCRYPT_KEY: "test-encryption-key-32-bytes!!"
+      S3PROXY_HOST: "http://minio:9000"
+      S3PROXY_REGION: "us-east-1"
+      S3PROXY_MEMORY_LIMIT_MB: "16"
+      S3PROXY_LOG_LEVEL: "WARNING"
+      AWS_ACCESS_KEY_ID: minioadmin
+      AWS_SECRET_ACCESS_KEY: minioadmin
+    depends_on:
+      - minio