Repository navigation
[Request]: --pids-limit flag for container run/create #2401
Description
Feature or enhancement request details
Add --pids-limit N (Docker-compatible) to container run and container create, setting the container cgroup's pids.max.
Use case
Untrusted workloads (for example sandboxed AI agents) need a process limit, so a fork bomb can't exhaust the VM. Today the only option is to start the container as root and have an init helper write /sys/fs/cgroup/pids.max itself before dropping privileges, which forces a privileged entrypoint.
Tested with container 1.5.0 on macOS 27.0.1.
Activity
gerardrecinto commentedon Oct 17, 2026
Hi @crosbymichael, could I take this on? I see the recent cgroup work in containerization, so I'd first check which resource settings the current container dependency exposes and whether this needs a change in both repositories.
I'd keep the scope to
--pids-limitfor run/create, persisted configuration, and applying the limit before the workload starts, with validation and a bounded integration test. What semantics would you prefer for an omitted limit, zero, and an explicit unlimited value?If this is available, could you assign it to me (@gerardrecinto) and confirm that a PR in this direction is welcome?
Thanks
Gerard Recinto