Caps the sidecar container at 320 MB of memory and 256 processes, and adds no-new-privileges, so a misbehaving sidecar cannot starve the 512 MB instance. This applies to new instances. On the current one, edit the unit and restart it: sudo sed -i "s/--read-only/--security-opt no-new-privileges --memory 320m --pids-limit 256 --read-only/" /etc/systemd/system/tangled-collaborator-sidecar.service && sudo systemctl daemon-reload && sudo systemctl restart tangled-collaborator-sidecar.
🤖 Generated with Claude Code