Github/nsjail
1
0
Fork 0
mirror of https://github.com/google/nsjail.git synced 2026-08-30 18:41:30 -07:00
Code Issues Packages Projects Releases Wiki Activity

nsjail: increase RLIMIT_NOFILE to min 8192

Browse Source
This commit is contained in:
Robert Swiecki
2026-03-31 08:32:40 +02:00
parent e49f75c528
commit ea5d664561
1 changed files with 27 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

28
nsjail.cc
View File

@@ -29,6 +29,7 @@
#include <stdlib.h>
#include <string.h>
#include <sys/ioctl.h>
#include <sys/resource.h>
#include <sys/time.h>
#include <termios.h>
#include <unistd.h>
@@ -119,6 +120,29 @@ static bool setTimer(nsj_t* nsj) {
return true;
}
static bool setFDLimit() {
constexpr uint64_t kRLimitNoFileDesired = 8192ULL;
struct rlimit64 rl;
if (util::getrlimit(RLIMIT_NOFILE, &rl) == -1) {
return false;
}
if (rl.rlim_cur >= kRLimitNoFileDesired) {
return true;
}
uint64_t target = std::min((uint64_t)kRLimitNoFileDesired, (uint64_t)rl.rlim_max);
if (target <= rl.rlim_cur) {
return true;
}
rl.rlim_cur = target;
if (util::setrlimit(RLIMIT_NOFILE, rl) == -1) {
PLOG_W("util::setrlimit(RLIMIT_NOFILE, %" PRIu64 ") failed", (uint64_t)rl.rlim_cur);
return false;
}
LOG_D("Increased RLIMIT_NOFILE to %" PRIu64, (uint64_t)rl.rlim_cur);
return true;
}
static bool pipeTraffic(nsj_t* nsj, int listenfd) {
std::vector<struct pollfd> fds;
fds.reserve(nsj->pipes.size() * 3 + 1);
@@ -339,10 +363,12 @@ int main(int argc, char* argv[]) {
if (!nsjail::setSigHandlers()) {
LOG_F("nsjail::setSigHandlers() failed");
}
if (!nsjail::setFDLimit()) {
LOG_E("nsjail::setFDLimit() failed");
}
if (!nsjail::setTimer(nsj.get())) {
LOG_F("nsjail::setTimer() failed");
}
if (nsj->njc.detect_cgroupv2()) {
cgroup2::detectCgroupv2(nsj.get());
LOG_I("Detected cgroups version: %d", nsj->njc.use_cgroupv2() ? 2 : 1);