Constant ENV_RLIMITS 

pub const ENV_RLIMITS: &str = "MSB_RLIMITS";

Environment variable carrying sandbox-wide resource limits.

Format: resource=limit[:hard][;resource=limit[:hard];...]

• resource — lowercase rlimit name such as nofile or nproc
• limit — soft limit
• hard — hard limit (optional; if omitted, uses the soft limit)

Examples:

• MSB_RLIMITS=nofile=65535
• MSB_RLIMITS=nofile=65535:65535;nproc=4096:4096

agentd applies these during PID 1 startup so every later guest process inherits the raised baseline instead of having to opt into per-exec rlimits.