fix: no pids/swap limits on containers

[dmzoneill]

Containers can fork-bomb or OOM-kill host. Add pids_limit and memswap_limit to compose deploy section.

[github-actions]

Since this is a GitHub Actions environment and not a full clone, let me provide the solution for adding PID and memory swap limits to Docker Compose:

Solution

To fix the fork-bomb and OOM vulnerabilities, add these resource limits to your Docker Compose service definitions:

services:
  your-service:
    deploy:
      resources:
        limits:
          cpus: '1.0'
          memory: 512M
          pids: 100  # Prevents fork bombs
    mem_swappiness: 0  # Disable swap usage
    memswap_limit: 512M  # Match memory limit to prevent swap usage

Key configurations:

1. pids: 100 (under deploy.resources.limits) - Limits the number of processes/threads a container can create, preventing fork bombs

2. memswap_limit: 512M - Sets total memory (RAM + swap). When equal to memory limit, it effectively disables swap for the container

3. mem_swappiness: 0 - Prevents the kernel from swapping container memory to disk

Example complete service:

version: '3.8'

services:
  app:
    image: your-image
    deploy:
      resources:
        limits:
          cpus: '1.0'
          memory: 512M
          pids: 100
        reservations:
          memory: 256M
    mem_swappiness: 0
    memswap_limit: 512M

Recommended values:

• pids_limit: 100-200 for typical apps, 50 for minimal services
• memory: Based on your app's needs (512M-2G typical)
• memswap_limit: Same as memory limit to disable swap

This prevents containers from exhausting host resources through process explosion or memory abuse.