The Danger of Runaway Processes
In a shared Linux environment—whether it’s a university development server, a corporate web server, or a multi-tenant cloud instance—system resources are finite. A single user running a poorly optimized script, an infinite loop, or a massive memory-intensive compilation can accidentally consume 100% of the CPU or RAM.
When this happens, the Linux kernel struggles to keep up. Other users experience severe lag, critical system daemons (like SSH or Apache) may crash due to Out-Of-Memory (OOM) errors, and the entire server can become completely unresponsive, requiring a hard reboot.
To prevent this, Linux administrators use the ulimit command. ulimit (User Limit) provides control over the resources available to the shell and to processes started by it. It acts as a safety valve, ensuring that no single process can devour the entire system.
Step 1: Understanding Soft vs. Hard Limits
ulimit enforces two types of limits:
- Hard Limits: This is the absolute ceiling set by the root administrator. A normal user cannot increase their limit above the hard limit. (Only root can raise a hard limit).
- Soft Limits: This is the current limit enforced on the user. A user can freely increase or decrease their soft limit, as long as they do not exceed the hard limit.
When a process hits the soft limit, the kernel will intervene. For example, if a process hits its memory limit, any further request for RAM will be denied, usually causing the program to crash with an error, but saving the rest of the server.
Step 2: Viewing Current Limits
To see all the current soft limits applied to your terminal session, use the -a (all) flag:
ulimit -a
You will see a list of resource types. Some of the most critical include:
- core file size (blocks, -c): The maximum size of a core dump file (often set to 0 to prevent large dumps from filling the disk).
- data seg size (kbytes, -d): The maximum size of a process’s data segment (RAM).
- max locked memory (kbytes, -l): Maximum amount of memory that can be locked into RAM (preventing it from being swapped to disk).
- open files (-n): The maximum number of file descriptors a process can have open simultaneously (crucial for web servers and databases).
- max user processes (-u): The maximum number of simultaneous processes the user is allowed to run.
- virtual memory (kbytes, -v): The total amount of virtual memory a process can address.
To view the Hard limits instead of the soft limits, add the -H flag:
ulimit -Ha
Step 3: Temporarily Restricting a Process
You can use ulimit to restrict resources for the current terminal session. Any command you run in this terminal will inherit these limits.
For example, suppose you are about to run an experimental Python script that you suspect has a memory leak. You want to restrict it to only 500 MB of virtual memory so it crashes itself instead of crashing the server.
In your terminal, you would run:
ulimit -v 512000
(Note: The -v flag expects the value in kilobytes. 500 MB * 1024 = 512,000 KB).
Then, you run your script:
python3 my_leaky_script.py
If the script attempts to allocate 501 MB of memory, the Linux kernel will instantly kill it with a MemoryError, protecting the system.
Step 4: Making Limits Permanent
The ulimit command only applies to the current terminal session. If you close the window, the limits reset.
To enforce permanent limits on specific users or groups across all logins, you must edit the system configuration file located at /etc/security/limits.conf.
You need root privileges to edit this file (e.g., sudo nano /etc/security/limits.conf).
The syntax follows this format:
<domain> <type> <item> <value>
For example, to permanently restrict a specific user named johndoe to a maximum of 50 simultaneous processes (to prevent them from accidentally launching a fork bomb), you would add this line to the bottom of the file:
johndoe hard nproc 50
To limit the entire developers group to 2 GB of memory:
@developers hard as 2097152
By properly configuring ulimit and limits.conf, administrators can ensure a stable, fair, and secure Linux environment for all users.