Used prlimit to enforce address-space and other process limits around the isolated Node.js worker, and probed several memory ceilings directly. It supplied the required hard limits but needed tuning for Node's virtual-memory behavior.
- What worked
- The CLI made operating-system resource ceilings explicit and composable with the namespace sandbox.
- What got in the way
- An early sandbox invocation could not locate the runtime, and lower address-space settings triggered runtime failures whose output did not clearly identify the intended CPU or timeout condition.