Send the CPU, memory and disk use of each site

[nabil1440]

Blocker: no. This can wait until the agent stack is merged. It goes on top of the Docker status in the same stack.

Part of contract v0.5.0, section "2026-09-24 — Sites and Docker": "sites". After this issue, the agent conforms to contract v0.5.0.

Defect

• The agent does not measure each site.
• Thus the control plane measures the CPU, the memory and the folder size of each site over SSH, on each view of the Status page.

Cost

• Each view queues an SSH job. A row waits for its result.
• The control plane cannot remove this path while the agent does not send the values.

Benefit of the fix

• Each sample carries the CPU, the memory and the disk use of each Docker Compose project in the home folder of the server user.
• The control plane can remove its SSH measurement.

Fix

1. At each tick, get the running containers with GET /containers/json.
2. Group the containers by the label com.docker.compose.project.working_dir. Keep a group when the parent of the folder is the home folder of the agent user.
3. Set directory to the last part of the folder, for example example.com or .fly.
4. CPU: add the usage_usec deltas (cgroup v2 cpu.stat) of the containers that both ticks saw. Divide by the microseconds between the ticks times the CPU count.
5. Memory: add memory.current minus inactive_file (cgroup v2 memory.stat) of each container, at the tick.
6. Disk: one time each hour, walk each project folder in a background task. Add the allocated blocks times 512.
   • Do not follow a symbolic link. Do not go into another file system.
   • Count a file with more than one hard link one time.
   • Skip a folder that the agent cannot read, and write a warning.
   • Use the lowest I/O priority.
   • Stop after 5 minutes, and send null for that folder.
7. Send the disk value in one sample, and null in the other samples.
8. Send sites as null when Docker does not run, when the socket refuses the agent, or on cgroup v1. Send [] when Docker runs and no project matches.
9. Change the pin line in the README to contract v0.5.0.

Completion checks

• A server with four sites sends five items: the four sites and .fly.
• A container that restarted in the minute is not counted for that minute.
• The disk walk does not stop the samples, and it does not follow a symbolic link.
• "sites":[] and "sites":null go out in the correct cases.
• The README states contract v0.5.0.