[Reliability] MongoDB_HealthCheck constructs a new MongoClient on every invocation (connection-pool leak) #433

New Issue

2026-07-06T03:05:46Z

spikerj commented

2026-07-06 03:05:46 +00:00

Problem

SpikerSoft.Api/Infrastructure/HealthChecks/MongoDB_HealthCheck.CheckHealthAsync does var client = new MongoClient(_connectionString); on every health-check invocation (the health pipeline polls every ~30s). MongoClient owns a cluster/connection pool with background monitor threads and is explicitly documented to be reused as a singleton — creating one per check slowly leaks pools/threads/sockets for the lifetime of the process.

Same anti-pattern class as #411 / PR #111 (GamePersistenceService). A DI singleton IMongoClient is already registered (SpikerSoft.Api/Extensions/ServiceCollectionExtensions.cs:319).

Fix

Inject the singleton IMongoClient and use it for the ping/settings instead of new MongoClient(...). Bonus: the health check then verifies the app's actual connection pool (more representative) rather than a throwaway one. Keep the config read only for the obfuscated connection-string display in messages.

Acceptance

No new MongoClient in the health-check path; the injected singleton is used.
Existing ObfuscateConnectionString tests still pass; DI can still construct the check (AddCheck<MongoDB_HealthCheck>).

Refs #411 (resource-leak availability bombs).

## Problem `SpikerSoft.Api/Infrastructure/HealthChecks/MongoDB_HealthCheck.CheckHealthAsync` does `var client = new MongoClient(_connectionString);` **on every health-check invocation** (the health pipeline polls every ~30s). `MongoClient` owns a cluster/connection pool with background monitor threads and is explicitly documented to be reused as a singleton — creating one per check slowly leaks pools/threads/sockets for the lifetime of the process. Same anti-pattern class as #411 / PR #111 (`GamePersistenceService`). A DI singleton `IMongoClient` is already registered (`SpikerSoft.Api/Extensions/ServiceCollectionExtensions.cs:319`). ## Fix Inject the singleton `IMongoClient` and use it for the ping/settings instead of `new MongoClient(...)`. Bonus: the health check then verifies the **app's actual** connection pool (more representative) rather than a throwaway one. Keep the config read only for the obfuscated connection-string display in messages. ## Acceptance - No `new MongoClient` in the health-check path; the injected singleton is used. - Existing `ObfuscateConnectionString` tests still pass; DI can still construct the check (`AddCheck<MongoDB_HealthCheck>`). Refs #411 (resource-leak availability bombs).

spikerj referenced this issue

2026-07-06 03:08:41 +00:00

[Reliability][Go-live] Eliminate availability bombs — Redis scans/flush, MongoClient-per-message, GPU ledger, poison requeue #411

spikerj commented

2026-07-06 03:15:31 +00:00

Resolved in spikersoft-backend PR #112 (merged to master). MongoDB_HealthCheck now takes the DI-registered singleton IMongoClient and uses it for the ping/settings instead of new MongoClient(...) per invocation — closing the per-check connection-pool/thread leak. Guarded by MongoDbHealthCheckConstructorTests (2) + the 21 existing obfuscation tests. Closing.

Resolved in spikersoft-backend PR #112 (merged to `master`). `MongoDB_HealthCheck` now takes the DI-registered singleton `IMongoClient` and uses it for the ping/settings instead of `new MongoClient(...)` per invocation — closing the per-check connection-pool/thread leak. Guarded by `MongoDbHealthCheckConstructorTests` (2) + the 21 existing obfuscation tests. Closing.

spikerj closed this issue

2026-07-06 04:51:18 +00:00

spikerj referenced this issue

2026-07-29 17:07:18 +00:00

[Go-Live Checklist][Container] Docker hardening: non-root USER, --no-install-recommends, disable curl/wget redirects (SonarQube hotspots S6471/S6500/S6506) #659

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: spikerj/spikersoft-issues#433