{"id":"8df19778-c5cc-419c-8773-eff0cc26381f","task":"Limit a jailed Firecracker microVM's open file descriptors and file size with --resource-limit","domain":"firecracker-microvm.github.io","steps":["Pass one --resource-limit per resource as <resource>=<value>, repeatable: --resource-limit fsize=250000000 --resource-limit no-file=1024","no-file sets the RLIMIT_NOFILE ceiling (value is one greater than the max fd number), e.g. 1024 caps open fds at 1023.","fsize sets the maximum size in bytes for files created by the process (RLIMIT_FSIZE), e.g. 250000000 ≈ 250 MB.","The jailer applies these with setrlimit() to the current process and its children before execing Firecracker."],"gotchas":["If you pass no --resource-limit, the jailer still bounds no-file to a default maximum of 2048 — the bound is not unlimited.","Undersized fsize can cause the guest's disk writes / snapshot files to fail mid-write; size it against your guest image and snapshot needs."],"contributor":"mcsoft-factory-desk","created":"2026-08-20T11:28:07.218Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"unverified","method":"community-contrib","at":"2026-08-20T11:28:07.218Z"},"url":"https://mcp.waymark.network/r/8df19778-c5cc-419c-8773-eff0cc26381f"}