retoor
af080fe68e
- Approval: re-prompt unknown answers (max 3), shell-only affirmative guidance recovery; destructive actions stay strict - GoalVerifier subagent with strict JSON verdicts, bounded follow-up rounds, nonzero exit plus open turn on unverified one-shots - Retrieval eval (Hit@K/MRR/nDCG/Context Precision), FTS cascade with title weighting, query/read event logging, --eval-retrieval CLI - Supervisor caps (8 parallel, 64 records) and scheduler hardening (4 fires/tick, per-schedule lease, stated misfire policy) - Sandbox box resource trio: 2g/2.0/256 at create, best-effort update for existing boxes, rm -f recovery pointer - Research archive: 12 subjects, 667 sources, 27 conclusions; suites 979 + 16 green
1.1 KiB
1.1 KiB
How Docker Works Under the Hood: cgroups stop a fork bomb
Metadata
| Field | Value |
|---|---|
| Institute | Molodetz Institute — Research & Retrieval Division |
| Subject | sandbox-resource-caps |
| Document type | Source Citation Card |
| Tier | 2 |
| Source title | How Docker Works Under the Hood: cgroups stop a fork bomb |
| Source URL | http://dev.to/devopsdaily/how-docker-works-under-the-hood-watch-namespaces-isolate-a-container-and-cgroups-stop-a-fork-bomb-2k22 |
| Source type | blog post |
| Date researched | 2026-10-18 |
| Researched by | tai (agent), model: Muse Spark, on behalf of retoor |
| Research method | Search aggregator result listing (not independently opened or quoted) |
| Confidence | Not independently verified |
| Status | Active |
Why it's here
Surfaced by the container-limits search; the snippet demonstrates docker run --pids-limit 100 setting the cgroup ceiling and notes that without the flag a runaway container is bounded only by host limits. Worked-example corroboration; seen only as a snippet.
Changelog
| Date | Change |
|---|---|
| 2026-10-18 | Logged as consulted-but-not-analyzed. |