[awf] sandbox.agent: no configurable pids/process ceiling, causing concurrent JVM build failures

[lpcox]

Problem
The AWF agent sandbox enforces a process/thread ceiling invisible from inside the container (no readable /sys/fs/cgroup pids files, ulimit -u reports unlimited, no config knob). Concurrent JVM-based build tools (javac, Android manifest merger) hit this ceiling and die with thread-creation failures that look like unrelated code bugs.

Context
github/gh-aw#51383

Root Cause
AWF likely applies a default cgroup pids.max (or similar) when constructing the agent container, but does not expose the limit value inside the container (cgroup files not bind-mounted/readable) and provides no sandbox.agent option to raise it. Tools relying on visible core count to size thread pools then over-subscribe and fail under concurrency.

Proposed Solution

1. Expose /sys/fs/cgroup/pids.max and pids.current (read-only) inside the agent container so JVM/build tools can self-limit.
2. Add a configurable process/pids limit (e.g. sandbox.agent.pids or similar) alongside the existing memory option, defaulting to current behavior for backward compatibility.
3. Document the default ceiling and how to raise it in docs/awf-config-spec.md.

Generated by Firewall Issue Dispatcher · auto · 26.4 AIC · ⊞ 8.9K · ◷