{"record":{"id":"dfb7f273c1fa8bc8","repo":"ory/hydra","slug":"failed-to-set-virtual-memory-limit-v","errorCode":null,"errorMessage":"failed to set virtual memory limit: %v","messagePattern":"failed to set virtual memory limit: (.+?)","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"oryx/jsonnetsecure/limit_unix.go","lineNumber":26,"sourceCode":"import (\n\t\"fmt\"\n\t\"runtime/debug\"\n\t\"syscall\"\n\n\t\"github.com/pkg/errors\"\n)\n\nfunc SetVirtualMemoryLimit(limitBytes uint64) error {\n\t// Tell the Go runtime about the limit.\n\tdebug.SetMemoryLimit(int64(limitBytes)) //nolint:gosec // The number is a compile-time constant.\n\n\tlim := syscall.Rlimit{\n\t\tCur: limitBytes,\n\t\tMax: limitBytes,\n\t}\n\terr := syscall.Setrlimit(syscall.RLIMIT_AS, &lim)\n\tif err != nil {\n\t\treturn errors.WithStack(fmt.Errorf(\"failed to set virtual memory limit: %v\", err))\n\t}\n\treturn nil\n}\n","sourceCodeStart":8,"sourceCodeEnd":30,"githubUrl":"https://github.com/ory/hydra/blob/4174065ffb052799890f7480f5360a877a67ffc1/oryx/jsonnetsecure/limit_unix.go#L8-L30","documentation":"SetVirtualMemoryLimit wraps syscall.Setrlimit(RLIMIT_AS) failures in this error. It is raised on Unix systems when the process cannot raise/change its address-space rlimit to the requested number of bytes.","triggerScenarios":"Calling SetVirtualMemoryLimit with a limit higher than the hard rlimit (EPERM), inside a container without CAP_SYS_RESOURCE when raising beyond the hard limit, or on systems where RLIMIT_AS is unavailable/restricted.","commonSituations":"Docker/Kubernetes containers with low default limits; sandboxed CI runners; running as non-root and asking for more virtual memory than the hard cap; misjudging that RLIMIT_AS counts virtual, not resident, memory.","solutions":["Log the wrapped %v to see the errno (EPERM vs EINVAL) and request a limit at or below the current hard limit (getrlimit)","Run the process with sufficient privileges (CAP_SYS_RESOURCE) or adjust the container/systemd limits","Use prlimit/ulimit -v at launch time instead of raising it in-process","Skip the limit call (make it optional) when the platform cannot honor it"],"exampleFix":"// before\nerr := jsonnetsecure.SetVirtualMemoryLimit(1 << 40) // 1TB on unprivileged container\n// after\nvar rl syscall.Rlimit\n_ = syscall.Getrlimit(syscall.RLIMIT_AS, &rl)\nerr := jsonnetsecure.SetVirtualMemoryLimit(rl.Max) // stay within hard limit","handlingStrategy":"fallback","validationCode":"var rl syscall.Rlimit\nif err := syscall.Getrlimit(syscall.RLIMIT_AS, &rl); err != nil {\n    return err\n}\nif limitBytes > rl.Max {\n    return fmt.Errorf(\"requested limit %d exceeds hard rlimit %d\", limitBytes, rl.Max)\n}","typeGuard":null,"tryCatchPattern":"if err := jsonnetsecure.SetVirtualMemoryLimit(limitBytes); err != nil {\n    log.Warn(\"could not set virtual memory limit, continuing without it\", \"err\", err)\n    // proceed unbounded rather than aborting startup\n}","preventionTips":["Read the hard rlimit first and never request more than Max","Account for container/CI sandbox privilege limits (EPERM without CAP_SYS_RESOURCE)","Treat the memory cap as best-effort: log-and-continue for non-critical paths","Remember RLIMIT_AS limits virtual memory — set generous values, not RSS targets"],"tags":["unix","rlimit","memory","syscall","go"],"backgroundTag":"rlimit-set-failed","analyzedSha":"4174065ffb052799890f7480f5360a877a67ffc1","analyzedAt":"2026-09-03T14:52:41.581Z","contentChangedAt":"2026-09-03T14:52:41.581Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}