ProcessKit API Reference
RlimitResource Type
A Unix **per-process** resource governed by `setrlimit(2)` and requested through `Command.Rlimit` — the per-child complement of the whole-tree `ResourceLimits` below. The two are different instruments and neither replaces the other. A `ResourceLimits` cap is enforced by the group's kernel container on every process in the tree AT ONCE (one memory budget shared by all of them); an rlimit is applied to the direct child before its program starts and is then INHERITED individually by each descendant, so ten descendants each get their own copy of the cap rather than a shared one. A descendant may lower its own limits further, and may raise its soft value back up as far as the hard value it inherited — an rlimit is a robustness bound, not a containment boundary (that is what the group is for). Every value is in the resource's own native unit, exactly as the syscall takes it: **bytes** for `Core`/`Data`/`FileSize`/`Stack`, **seconds** for `Cpu`, a **count** for `NoFile`. There is no "unlimited" value — this API exists to LOWER a limit the child inherited, and raising a hard limit needs privilege the kernel refuses to an ordinary caller (the refusal is honest: the child never runs). **Unix-only**, and honestly so: Windows has no `setrlimit` analogue, so a spawn carrying any rlimit fails there with `ProcessError.Unsupported` rather than running the child uncapped. On POSIX the limits are applied before the child's own program starts by the util-linux `prlimit` helper, loaded only from a trusted system directory; a host that holds it in none of them (macOS/BSD, a minimal image) fails with `ProcessError.ResourceLimit` — see `Command.Rlimit` for the full mechanism.
Union cases
| Union case |
Description
|
Full Usage:
Core
|
Maximum size in **bytes** of a core dump (`RLIMIT_CORE`). `0, 0` disables core dumps outright, which is the honest default for a child handling secrets: a core file is a verbatim copy of its memory, written where the host's core pattern says rather than where this process decides. |
Full Usage:
Cpu
|
Maximum CPU time in **seconds** (`RLIMIT_CPU`). The soft value raises `SIGXCPU` (which terminates a child that does not handle it), the hard value is an unblockable `SIGKILL`. This is the one axis the whole-tree `ResourceLimits.CpuTimeMax` also targets — see `Command.Rlimit` for how the two compose. |
Full Usage:
Data
|
Maximum size in **bytes** of the process data segment (`RLIMIT_DATA`) — the `brk`/`mmap` allocation arena on Linux, so an allocation past it fails inside the child (an allocator error) rather than taking memory from the rest of the host. |
Full Usage:
FileSize
|
Maximum size in **bytes** of a file the process may create or extend (`RLIMIT_FSIZE`). A write past the soft value raises `SIGXFSZ`; a child that handles or blocks it gets `EFBIG` instead. The cap a runaway log or an unbounded temp file needs. |
Full Usage:
NoFile
|
Maximum **number** of simultaneously open file descriptors (`RLIMIT_NOFILE`). Counts the descriptors ProcessKit itself hands the child (its stdio, any `Command.ExtraFd` channel), so leave headroom for them. |
Full Usage:
Stack
|
Maximum size in **bytes** of the process stack (`RLIMIT_STACK`). Bounds runaway recursion in the child's main thread; a thread the child creates itself is governed by whatever stack size that child requests. |
Instance members
| Instance member |
Description
|
Full Usage:
this.IsCore
Returns: bool
|
|
Full Usage:
this.IsCpu
Returns: bool
|
|
Full Usage:
this.IsData
Returns: bool
|
|
Full Usage:
this.IsFileSize
Returns: bool
|
|
Full Usage:
this.IsNoFile
Returns: bool
|
|
Full Usage:
this.IsStack
Returns: bool
|
|
Full Usage:
this.Name
Returns: string
|
This resource's **stable machine identifier**: a short, lowercase `snake_case` string, part of the library's compatibility surface. Use it wherever a resource has to travel as text — a config file's key, a CLI flag, a structured log field — instead of hand-maintaining a mapping table. It is a diagnostic identifier rather than a wire format, but it is held stable all the same: a new resource gets a NEW identifier and an existing one is never renamed within a major version. `TryFromName` parses it back.
|
Static members
| Static member |
Description
|
|
Every resource, in a fixed order — the enumerable form of the set `Name`/`TryFromName` map between, so a config layer can validate or document the accepted spellings without keeping its own copy of the list (which could silently fall behind a new resource).
|
|
`TryFromName` for a caller that wants the miss as an error instead of an option — an unknown name raises `ArgumentException` listing every accepted spelling, so a mistyped config key fails where it is read rather than silently applying no limit. `null` raises `ArgumentNullException`.
|
Full Usage:
RlimitResource.TryFromName(name)
Parameters:
string
Returns: RlimitResource option
|
Parse a stable `Name` identifier back into a resource, or `None` for anything that is not EXACTLY one of them (matching is ordinal and case-sensitive: `"NoFile"` and `"nofile"` are both misses, only `"no_file"` hits). An honest miss, never a silent default — a config-driven caller that mistypes a resource gets nothing back to apply, instead of a limit quietly landing on the wrong axis or on none at all. Round-trips with `Name` for every resource.
|