Repository navigation
[SECURITY] No process limit (ulimit -u unlimited) — fork bomb unprotected #809
Description
Summary
The sandbox user has ulimit -u unlimited, meaning there is no protection against fork bombs or process exhaustion attacks. A prompt-injected agent could DoS the host by spawning processes until the system runs out of resources.
Reproduction
$ ulimit -u
unlimited
$ ulimit -n
1024
File descriptor limit is set (1024) but process limit is unbounded.
Impact
A simple :(){ :|:& };: or while true; do sleep 1 & done from inside the sandbox would exhaust host PID space and potentially crash the entire system, including the OpenShell gateway and other sandboxes.
Recommendation
Set a reasonable process limit via the container runtime (e.g. --pids-limit 256 in Docker, or a pids cgroup limit). This is a one-line fix in the sandbox container spec.
Environment
- openshell 0.0.14
- Base sandbox image:
ghcr.io/nvidia/openshell-community/sandboxes/base:latest - DGX Spark (aarch64)
Activity
fix: add fork bomb protection via process limits (NVIDIA#809)
fix: add fork bomb protection via process limits (NVIDIA#809)
cluster2600 commentedon Mar 24, 2026
Related: #796 proposes a command pattern denylist that would provide application-level coverage for this class of issue. Worth addressing together — the image hardening here is the defence-in-depth layer (remove the tool entirely), whilst #796 catches the patterns even if the tool is present via a different path.
fix: harden sandbox image — remove unnecessary tools, drop capabiliti…
BenediktSchackenberg commentedon Mar 24, 2026
Addressed in #830 — added ulimit -u 512 in both the ENTRYPOINT and start script to cap process count.
security: enforce process limit to prevent fork bombs in sandbox (NVI…
fix: add fork bomb protection via process limits (NVIDIA#809)
fix: add fork bomb protection via process limits (NVIDIA#809)
fix: harden sandbox image — remove unnecessary tools, drop capabiliti…
fix: harden sandbox image — remove unnecessary tools, drop capabiliti…
fix: harden sandbox image — remove gcc/netcat, add process limits, dr…
fix: make ulimit best-effort and fix PATH test to walk script line-by…
fix: make ulimit best-effort and fix PATH test to walk script line-by…
fix: make ulimit best-effort, fix PATH test regression (#947)
BenediktSchackenberg commentedon Mar 26, 2026
Fixed via #830 (merged). Process limit enforced: ulimit -u 512 is set in both the ENTRYPOINT and the start script, preventing fork bombs and process exhaustion.
cluster2600 commentedon Mar 26, 2026
thanks!
fix: add fork bomb protection via process limits (NVIDIA#809)
fix: add fork bomb protection via process limits (NVIDIA#809)
fix: harden sandbox image — remove gcc/netcat, add process limits, dr…
fix: make ulimit best-effort, fix PATH test regression (NVIDIA#947)
fix: add fork bomb protection via process limits (NVIDIA#809)
fix: add fork bomb protection via process limits (NVIDIA#809)
fix: add fork bomb protection via process limits (NVIDIA#809)
fix(sandbox): cap sandbox open file descriptors (nofile) at entrypoint
fix(sandbox): cap sandbox open file descriptors (nofile) at entrypoint (