Set RLIMIT_NPROC based on a setting, default 5.

codejail/jail_code.py

@@ -75,6 +75,8 @@ LIMITS = {
     "VMEM": 0,
     # Size of files creatable, in bytes, defaulting to nothing can be written.
     "FSIZE": 0,
+    # The number of processes and threads to allow.
+    "NPROC": 5,
     # Whether to use a proxy process or not.  None means use an environment
     # variable to decide. NOTE: using a proxy process is NOT THREAD-SAFE, only
     # one thread can use CodeJail at a time if you are using a proxy process.
@@ -104,6 +106,9 @@ def set_limit(limit_name, value):
         * `"FSIZE"`: the maximum size of files creatable by the jailed code,
             in bytes.  The default is 0 (no files may be created).
 
+        * `"NPROC"`: the maximum number of process or threads creatable by the
+            jailed code.  The default is 5.
+
         * `"PROXY"`: 1 to use a proxy process, 0 to not use one. This isn't
             really a limit, sorry about that.
 
@@ -262,8 +267,11 @@ def create_rlimits():
     """
     rlimits = []
 
-    # No subprocesses.
-    rlimits.append((resource.RLIMIT_NPROC, (0, 0)))
+    # Allow a small number of subprocess and threads.  One limit controls both,
+    # and at least OpenBLAS (imported by numpy) requires threads.
+    nproc = LIMITS["NPROC"]
+    if nproc:
+        rlimits.append((resource.RLIMIT_NPROC, (nproc, nproc)))
 
     # CPU seconds, not wall clock time.
     cpu = LIMITS["CPU"]