Bound Box PID count with --pids-limit=4096 - #165
Open
BrettKinny wants to merge 1 commit into
Open
Conversation
A runaway Box process could previously fork-bomb the host by exhausting its process table. All lifecycle adapters (Bash, PowerShell, Compose) and the rootless Podman e2e gate now pass --pids-limit=4096. The existing capability set was audited empirically against rootless Podman (keep-id): every one of CHOWN, DAC_OVERRIDE, FOWNER, SETUID, SETGID, and KILL is load-bearing for the passwordless-sudo APT provisioning contract, so no capability reduction is possible without redesigning that operational control. Verified locally with rootless Podman: provisioning (tmux via setup.sh --reconcile-box), workspace ownership parity, Managed-home persistence across stop/start, and pids.max=4096 enforcement.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Adds
--pids-limit=4096to every Box creation path:install.sh(Bash adapter)install.ps1(PowerShell adapter)docker-compose.yml(pids_limit).github/workflows/e2e.ymlrootless Podman gateWhy
A runaway Box process could previously fork-bomb the host by exhausting its process table. The Box already runs with
--cap-drop=ALLand a tailored capability set; bounding PIDs closes the remaining cheap resource-exhaustion vector.Capability audit (negative result)
The original plan also included reducing the capability set for rootless Podman. Empirically disproved: running the published image rootless (
keep-id:uid=1000,gid=1000) with reduced caps shows that every one of CHOWN, DAC_OVERRIDE, FOWNER, SETUID, SETGID, and KILL is load-bearing for the passwordless-sudo APT provisioning contract (setup.sh --reconcile-box→sudo -n apt-get install). No capability reduction is possible without redesigning that operational control.Verification
pids.max = 4096enforced.tests/test-*.shpass.test-lifecycle-install-state.sh(mock runtime records the flag),test-lifecycle-powershell.ps1(source contract),test-e2e-evidence.sh(workflow gate).