rlimit.MaxPID = &taskMax
	}

	// Prefer to read "/proc/loadavg" when possible because sysinfo(2)
	// returns truncated number when greater than 65538. See
	// https://github.com/kubernetes/kubernetes/issues/107107
	if procs, err := runningTaskCount(); err == nil {
		rlimit.NumOfRunningProcesses = &procs
	} else {
		var info syscall.Sysinfo_t
		syscall.Sysinfo(&info)
		procs := int64(info.Procs)

//sys	Pwrite(fd int, p []byte, offset int64) (n int, err error)
//sys	Prctl(option int, arg2 uintptr, arg3 uintptr, arg4 uintptr, arg5 uintptr) (err error) = SYS___PRCTL_A
//sysnb	Prlimit(pid int, resource int, newlimit *Rlimit, old *Rlimit) (err error) = SYS_PRLIMIT
//sys	Rename(from string, to string) (err error) = SYS___RENAME_A
//sys	Renameat(olddirfd int, oldpath string, newdirfd int, newpath string) (err error) = SYS___RENAMEAT_A

// Limit limit clause
type Limit struct {
	Limit  *int
	Offset int
}

// Name where clause name
func (limit Limit) Name() string {
	return "LIMIT"
}

// Build build where clause
func (limit Limit) Build(builder Builder) {
	if limit.Limit != nil && *limit.Limit >= 0 {
		builder.WriteString("LIMIT ")
		builder.AddVar(builder, *limit.Limit)
	}
	if limit.Offset > 0 {
		if limit.Limit != nil && *limit.Limit >= 0 {

# This example shows how to use Istio local rate limiting with descriptors to limit by path. 
# This uses the base book-info demo and adds rate limiting by path, specifically rate limiting the product page
# to 10 requests per minute, and the overall fdqn will be able to accept 100 requests per minute. 
apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  name: filter-local-ratelimit-svc
  namespace: istio-system
spec:
  workloadSelector:

// license that can be found in the LICENSE file.

//go:build unix && !darwin

package syscall

// adjustFileLimit adds per-OS limitations on the Rlimit used for RLIMIT_NOFILE. See rlimit.go.

	debug.SetTraceback("crash")

	var lim syscall.Rlimit
	err := syscall.Getrlimit(syscall.RLIMIT_CORE, &lim)
	if err != nil {
		panic(fmt.Sprintf("error getting rlimit: %v", err))
	}
	lim.Cur = lim.Max
	fmt.Fprintf(os.Stderr, "Setting RLIMIT_CORE = %+#v\n", lim)
	err = syscall.Setrlimit(syscall.RLIMIT_CORE, &lim)
	if err != nil {
		panic(fmt.Sprintf("error setting rlimit: %v", err))
	}
}

func main() {
	flag.Parse()

// license that can be found in the LICENSE file.

//go:build unix

package syscall

import "sync/atomic"

func OrigRlimitNofile() *Rlimit {
	return origRlimitNofile.Load()
}

func GetInternalOrigRlimitNofile() *atomic.Pointer[Rlimit] {
	return &origRlimitNofile

	// For open file count,
	// macOS sets the default soft limit to 256 and no hard limit.
	// CentOS and Fedora set the default soft limit to 1024,
	// with hard limits of 4096 and 524288, respectively.
	// Check that we can open 1200 files, which proves
	// that the rlimit is being raised appropriately on those systems.
	fileCount := 1200

	// OpenBSD has a default soft limit of 512 and hard limit of 1024.
	if runtime.GOOS == "openbsd" {

	} else {
		podStats, err = sp.provider.ListPodStats(ctx)
	}
	if err != nil {
		return nil, fmt.Errorf("failed to list pod stats: %v", err)
	}

	rlimit, err := sp.provider.RlimitStats()
	if err != nil {
		return nil, fmt.Errorf("failed to get rlimit stats: %v", err)
	}

	nodeStats := statsapi.NodeStats{
		NodeName:         node.Name,
		CPU:              rootStats.CPU,
		Memory:           rootStats.Memory,

			memLimit = resource.NewQuantity(runtimeStatusResources.MemoryLimitInBytes, resource.BinarySI)
		}

		if cpuLimit != nil || memLimit != nil {
			cStatusResources = &kubecontainer.ContainerResources{
				CPULimit:    cpuLimit,
				MemoryLimit: memLimit,
			}
		}
	}
	return cStatusResources
}

func toKubeContainerUser(statusUser *runtimeapi.ContainerUser) *kubecontainer.ContainerUser {
	return nil