limit CPU seconds in nsjail on the default/sample tasks about kctf HOT 4 OPEN

@sroettger

is this cgroup_cpu_ms_per_sec? or --time_limit? or --rlimit_cpu?

the cgroup one limits you if you use more than 1 CPU, so that you dont use more than that (otherwise you can fork/etc). the other 2 default to 600 already.

I think rlimit belongs to the process, so forking allows you to make a 4 CPU VM end up giving you 40m of CPU time, unless the task has max_cpu.

from kctf.

so ideally, a single connection shouldn't be able to hog the whole CPU. Maybe we should just set cgroup_cpu_ms_per_sec to 20-50% or so?

from kctf.

yea sounds good

from kctf.

this probably doesn't need to be in the beta tag? I.e. we already have limits in place and it's possible to tighten them if you want.

from kctf.