Upload sandbox.py with huggingface_hub

sandbox.py

@@ -146,20 +146,19 @@ def _preexec():
     resource.setrlimit(resource.RLIMIT_AS, (mem, mem))
     resource.setrlimit(resource.RLIMIT_FSIZE, (64 * 1024 * 1024, 64 * 1024 * 1024))
 
-    # RLIMIT_NPROC counts processes per *user*, not per process tree, so it
-    # includes everything the container is already running under this uid. A
-    # tight cap here made rustc fail to spawn its own threads:
-    #   Os { code: 11, kind: WouldBlock, message: "Resource temporarily unavailable" }
-    # Set high enough that a compiler's thread pool always fits, while still
-    # bounding a runaway fork loop. Never lower than the existing soft limit,
-    # since raising it back is not permitted for an unprivileged process.
-    try:
-        soft, hard = resource.getrlimit(resource.RLIMIT_NPROC)
-        target = 4096 if hard == resource.RLIM_INFINITY else min(4096, hard)
-        if soft == resource.RLIM_INFINITY or target > soft:
-            resource.setrlimit(resource.RLIMIT_NPROC, (target, hard))
-    except (ValueError, OSError):
-        pass  # not fatal - CPU time, memory, and the wall-clock kill still apply
+    # RLIMIT_NPROC is deliberately NOT set.
+    #
+    # It counts processes per *user*, not per process tree, so any cap here also
+    # counts every thread the host container already runs under this uid. In
+    # practice that starved the compilers of threads:
+    #   rustc: Os { code: 11, kind: WouldBlock, ... }
+    #   g++:   cannot execute cc1plus: vfork: Resource temporarily unavailable
+    # Both are EAGAIN from the fork itself. Because the limit is shared with
+    # processes we did not start and cannot count, any value is either too low
+    # to compile or too high to matter - it is not a usable control here.
+    #
+    # A fork bomb is still bounded by RLIMIT_CPU, RLIMIT_AS, and the wall-clock
+    # kill, which terminates the entire process group.
     # New process group so a timeout kill takes any children with it.
     os.setsid()