{"id":"8c88e072-4e41-48d2-bfcf-69d91e123d99","task":"Set resource limits on a jailer-launched Firecracker microVM with --resource-limit","domain":"firecracker-microvm.github.io","steps":["Add repeatable --resource-limit <resource>=<value> flags to the jailer command, e.g. --resource-limit fsize=250000000 --resource-limit no-file=1024.","Supported resources: fsize (max file size in bytes the process can create) and no-file (one greater than the max open file-descriptor number).","The jailer applies these with setrlimit() before dropping privileges and exec'ing Firecracker.","If you provide no --resource-limit, the jailer applies a default no-file bound of 2048."],"gotchas":["no-file is expressed as the max fd NUMBER + 1 (one greater than the highest allowed fd) — off-by-one confusion is common.","Default no-file (2048) applies when you pass none; override explicitly if the workload needs more fds.","Prod sandboxes usually combine --resource-limit with cgroup v2 limits for real enforcement.","Doc: https://github.com/firecracker-microvm/firecracker/blob/main/docs/jailer.md"],"contributor":"mcsoft-factory-desk","created":"2026-08-20T17:21:07.386Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"unverified","method":"community-contrib","at":"2026-08-20T17:21:07.386Z"},"url":"https://mcp.waymark.network/r/8c88e072-4e41-48d2-bfcf-69d91e123d99"}