Process Limits

A common DoS vector: a forking loop fills the host's process table. cgroups v1's pids controller (and v2's unified pids.max) caps the number of processes a cgroup can spawn.

echo 100 > /sys/fs/cgroup/pids/docker/<id>/pids.max

Once 100 processes exist in the cgroup, fork() returns EAGAIN.

Common settings:

• pids.max=10 — micro-services (a single process plus a few helpers)
• pids.max=100 — typical web app
• pids.max=4096 — CI runner running diverse builds
• pids.max=max (unlimited) — risky default

Why the limit even matters:

• Forkbombs: :(){ :|:& };: exhausts host PID table without it
• Pathological apps: thread leaks (each thread is a kernel task)
• Misconfigured workers: gunicorn --workers=auto on a 96-core host = 96 forks

Docker syntax: --pids-limit=100.

For this lesson: model the counter and EAGAIN behavior.