Emelia/Emi on Nostr: Yeah I'd say for media files, unless you have a specially-hardened fully-memory-safe ...

Yeah I'd say for media files, unless you have a specially-hardened fully-memory-safe parser (that supports first-class resource limits for stuff like zip-bomb prevention), you're better off stuffing that off into a subprocess call to let the OS do the resource limits for you, even if the subprocess is still using "safe" parsers.

If you're using subprocess sandboxing anyways, I'd also consider looking into cgroups for additional resource limits; they can do a lot more than you might think, including memory and CPU time and such *as a subset of their parent cgroup*, so you can make it so they can never starve the service itself of CPU time, even if you have the service already limited by a cgroup and accidentally start shitloads of them at once.