MemCordon runs a command and its descendants with optional workload-wide memory and elapsed-time limits. Use it when builds, tests, workers, or other commands can spawn child processes and need one containment boundary with reliable cleanup and exit-status reporting.
Sealed providers can additionally enforce an explicitly granted workload
contract with --sealed --workload-contract contract.json. Admission checks the
authenticated caller, exact grant and policy epoch before releasing the target;
it does not add network authority to the provider's existing baseline. See the
workload contract specification for registry
administration, supported profiles, discovery, and qualification requirements.
Download the latest release
for your platform and put memcordon (.exe) on PATH, or install with Cargo:
cargo install memcordonInstallation from source requires Rust 1.85 or newer.
Apply a 1 GiB memory limit and a 10-minute deadline:
memcordon +1GiB +10m ./workload./workload and any following arguments are passed through unchanged. MemCordon
returns the direct command's exit status after required cleanup succeeds, unless
a higher-precedence limit or supervision failure occurs.
| Status | Meaning |
|---|---|
123 |
Deadline |
124 |
Confirmed memory limit |
125 |
Wrapper or cleanup failure |
--restart can relaunch the workload after configured limits; its
conditions and delays are configurable.
Linux and Windows use cgroup v2 or Job Objects for hard memory enforcement when
the host permits it. macOS uses sampled watchdog monitoring, which can overshoot
or miss short bursts. memcordon doctor --json reports backend capabilities and
host limitations without launching a workload.
On macOS the guardian owns the target and services its deadline independently of ordinary sampling. Setup counts toward the budget, with separate bounded cleanup and result-delivery reserves. Reports use schema 10 and distinguish confirmed execution from unknown authorization or incomplete cleanup; see the deadline contract.
- Run
memcordon --helpormemcordon helpfor command-line reference. - See the contract reference for policies, platform behavior, reports, and exit codes.
- Review the changelog or MIT license.