Hacker News Reader

Does each session run in an isolated container? Because I wonder, what's stopping an attacker from exhausting system resources, messing with other users stuff, etc.?

View on HN

Yes it's a cloud function, an isolated docker container running node.js

Ah yeah, the fork bomb.

Modern kernels provide the pids cgroup, which specifically protects against forkbombs. Most container runtimes support it as well.

Reply on news.ycombinator.com