Subject: reasonable rlimit ranges for container processes

Hello,

Apologies if this is not the right place to ask. I could not find a
more specific venue for questions about rlimit usage in containers, so
pointers to a better list would be welcome.

I work on Kubernetes and am looking into sensible rlimit ranges for
container processes.

The ranges currently under consideration are:

  RLIMIT_NOFILE:  RLIM_INFINITY, or 256 .. 65536
  RLIMIT_MEMLOCK: RLIM_INFINITY, or 8192 .. 16 GiB
  RLIMIT_CORE:    RLIM_INFINITY, or 0 .. 16 GiB
  RLIMIT_NICE:    RLIM_INFINITY, or 0 .. 40
  RLIMIT_RTPRIO:  RLIM_INFINITY, or 0 .. 99
  RLIMIT_STACK:   RLIM_INFINITY, or 256 KiB .. 16 GiB

These ranges would apply to both the soft and hard limits, with the
soft limit required to be no greater than the hard limit.

The intention is to reject values that are likely to prevent a
container from starting, or that do not appear to have a useful
meaning in practice.

I would greatly appreciate help checking whether these ranges are
reasonable. This is not an area in which I have much experience.
Although I have done some local testing, I am still not confident that
these ranges are safe and useful across a broad range of Linux systems
and workloads.

Any corrections, suggestions, or references to earlier discussions
would be greatly appreciated.

Thanks,
Bing Hongtao