How to limit physical memory usage (RLIMIT_RSS)?

[lamar-studio]

Could you advise on how to effectively constrain the physical memory (RSS) usage in a sandbox environment? Through my testing, the --rlimit-as option appears to primarily limit virtual memory (AS). Might there be alternative configuration methods specifically targeting physical memory allocation?

[rusty-snake]

CGroup memory controller is what you're looking for.

[lamar-studio]

CGroup memory controller is what you're looking for.

Thank you very much for your response. Currently, we can only use cgroups to limit a process's physical memory. Additionally, I would like to know if future releases of Firejail will support physical memory limitations?

[kmk3]

I would like to know if future releases of Firejail will support physical
memory limitations?

No idea.

You can open a feature request for that to ensure that it's at least being
tracked:

• https://github.com/netblue30/firejail/issues/new?template=feature_request.md

[kmk3]

How to effectively constrain the physical memory (RSS) usage in a sandbox
environment?

There is no firejail command to do this.

Edit: The following is wrong; see the comments below.

Besides cgroups, it also seems to work with prlimit(1).

Example:

$ prlimit --rss=1000 firejail sh -c 'sleep 1000'
[...]
Parent pid 10000, child pid 10001
[...]
$ prlimit --pid 10001 | grep RSS
RSS        max resident set size                   1000      1000 bytes

[rusty-snake]

This limit has effect only in Linux 2.4.x, x < 30, and there affects only calls to madvise(2) specifying MADV_WILLNEED.

[kmk3]

This limit has effect only in Linux 2.4.x, x < 30, and there affects only
calls to madvise(2) specifying MADV_WILLNEED.

Nice finding, thanks.

I see now that it's mentioned in getrlimit(2) and prlimit(2) but not in
prlimit(1).

Misc: I also found a kernel module for it (which is apparently unmaintained):

• https://github.com/parke/rlimit_rss