//go:build linux

package console

import "syscall"

// limitVerifierMemory caps the verifier child's private writable memory
// (RLIMIT_DATA, which Linux applies to anonymous mappings since 4.7) so a
// tiny database declaring a 16-million-entry map dies in the child, not by
// exhausting the console's cgroup (code review R10-1). The database file's
// own read-only mapping does not count against it.
func limitVerifierMemory(bytes uint64) error {
	return syscall.Setrlimit(syscall.RLIMIT_DATA, &syscall.Rlimit{Cur: bytes, Max: bytes})
}