govips lifecycle
Separate process-level Startup/Shutdown from the Close responsibility of each ImageRef and avoid confused ownership. Lifecycle rules
Production
Successfully processing one image is not the same as operating a safe long-running service. This section focuses on process and object lifecycle, external-input limits, observability, and the evidence to preserve when a failure occurs.
Current production topics
Section titled “Current production topics”Untrusted input
Understand what loader blocking does and does not protect, then enforce byte, pixel, page, and time limits in the application. Input security boundaries
Runtime diagnosis
Section titled “Runtime diagnosis”Production memory behaviour spans the Go heap, libvips caches, native allocators, and process RSS. Use suspected memory leak diagnosis to build a repeatable experiment; for crashes or races, open concurrency safety.
Before deployment
Section titled “Before deployment”- Pin and record the actual libvips and binding versions.
- Define input-byte, pixel, page-count, and execution-time limits.
- Release clearly owned resources on every error path.
- Preserve reproducible minimal inputs and logs for high-risk operations.
- Do not generalise a workstation benchmark or a single RSS sample into a universal capacity claim.