Richard/ClawdDotNet
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Sandbox: Prozessgrenze auch unter dash (ulimit -p) (#654)

Browse Source 
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
Richard
2026-09-25 20:30:01 +02:00
co-authored by Claude Opus 5.5
parent da39fb3e91
commit 0bf08a18fe
1 changed files with 3 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/ClawdDotNet.Core/Sandbox/BwrapSandbox.cs
+3 -2
View File
@@ -186,8 +186,9 @@ public sealed class BwrapSandbox : ISandboxRunner
args.AddRange(["--seccomp", "3", "--"]);
// Inner: the process limit, set inside the sandbox's own user namespace.
args.AddRange([Shell, "-c", """ulimit -u "$1" || exit 126; shift; exec "$@" """, "sh",
// Inner: the process limit, set inside the sandbox's own user namespace. bash calls it
// -u, dash (Debian's and Ubuntu's sh) -p; if neither takes, nothing runs.
args.AddRange([Shell, "-c", """ulimit -u "$1" 2>/dev/null || ulimit -p "$1" || exit 126; shift; exec "$@" """, "sh",
limits.MaxProcesses.ToString(CultureInfo.InvariantCulture), request.Executable]);
args.AddRange(request.Arguments);
return args;