Upload sandbox.py with huggingface_hub

sandbox.py

@@ -49,7 +49,10 @@ RUN_TIMEOUT = int(os.getenv("RUN_TIMEOUT", "60"))
 
 # POSIX-only resource ceilings.
 MAX_CPU_SECONDS = int(os.getenv("MAX_CPU_SECONDS", "60"))
-MAX_MEMORY_MB = int(os.getenv("MAX_MEMORY_MB", "2048"))
+# rustc with -C lto=fat is memory-hungry; 2 GB was tight enough to risk killing
+# legitimate compiles. The free Spaces container has 16 GB, so this is generous
+# without being unbounded.
+MAX_MEMORY_MB = int(os.getenv("MAX_MEMORY_MB", "4096"))
 MAX_OUTPUT_CHARS = 20_000
 
 
@@ -142,8 +145,21 @@ def _preexec():
     mem = MAX_MEMORY_MB * 1024 * 1024
     resource.setrlimit(resource.RLIMIT_AS, (mem, mem))
     resource.setrlimit(resource.RLIMIT_FSIZE, (64 * 1024 * 1024, 64 * 1024 * 1024))
-    # No forking - blocks fork bombs and most attempts to outlive the timeout.
-    resource.setrlimit(resource.RLIMIT_NPROC, (64, 64))
+
+    # RLIMIT_NPROC counts processes per *user*, not per process tree, so it
+    # includes everything the container is already running under this uid. A
+    # tight cap here made rustc fail to spawn its own threads:
+    #   Os { code: 11, kind: WouldBlock, message: "Resource temporarily unavailable" }
+    # Set high enough that a compiler's thread pool always fits, while still
+    # bounding a runaway fork loop. Never lower than the existing soft limit,
+    # since raising it back is not permitted for an unprivileged process.
+    try:
+        soft, hard = resource.getrlimit(resource.RLIMIT_NPROC)
+        target = 4096 if hard == resource.RLIM_INFINITY else min(4096, hard)
+        if soft == resource.RLIM_INFINITY or target > soft:
+            resource.setrlimit(resource.RLIMIT_NPROC, (target, hard))
+    except (ValueError, OSError):
+        pass  # not fatal - CPU time, memory, and the wall-clock kill still apply
     # New process group so a timeout kill takes any children with it.
     os.setsid()