Skip to main content

Fork Bomb Simulator

Visualize how the infamous :(){ :|:& };: fork bomb works. Watch processes multiply exponentially, exhaust system resources, and learn how to protect against it with ulimit, cgroups, and systemd.

Category: Security

What You Will Learn

  • Understand how fork bombs create exponential process growth
  • See how resource exhaustion leads to system crashes
  • Learn to prevent fork bombs with ulimit, cgroups, and systemd

Topics covered: linux, bash, security, processes, educational, interactive

// simulator

Fork Bomb Simulator

Visualize how the infamous :(){ :|:& };: fork bomb works. Watch processes multiply exponentially, exhaust system resources, and learn how to protect against it with ulimit, cgroups, and systemd.

Supported byBecome a sponsor
BitriseAtomsizedDigitalOceanDevDojoSMTPfastQuizAPI

Fork Bomb Simulator

Visualize how the infamous fork bomb works and why it crashes systems in seconds

How the Fork Bomb Works
:(){ :|:& };:

Hover over each part to see what it does. The function calls itself twice, piping to a background copy - exponential growth.

Press Start to unleash the fork bomb

Process Log
$ waiting...
Controls
System Resources
Processes0.0 / 512
CPU0.0% / 100%
Memory0.0MB / 256MB
Protection
Why Fork Bombs Are Dangerous

Exponential Growth

Each process spawns 2 more. After 10 iterations: 1,024 processes. After 20: over 1 million. Most systems hit their PID limit well before that.

Resource Exhaustion

Every process consumes CPU time, memory, and a process table entry. The kernel scheduler gets overwhelmed trying to context-switch between thousands of processes.

Prevention

Set process limits with ulimit -u, use cgroups, or configure TasksMax in systemd unit files. Most modern distros set sane defaults.

Overview

The Bash fork bomb :(){ :|:& };: fits in thirteen characters and can freeze a Linux machine that has no process limits. This simulator takes it apart symbol by symbol: the colon is the function name, the body calls the function twice through a pipe, the ampersand sends the copies to the background, and the final colon starts it. Then it runs a safe visual version, so you can watch the process count grow exponentially until it hits the PID limit and the system runs out of room to start anything new, including the shell you would use to stop it. The second half is about defense. Three protections each cap a user at 100 processes: ulimit -u in the shell, pids.max in a cgroup, and TasksMax in a systemd unit. You can change the system PID limit and see that a protection only helps when its cap is lower than the system-wide limit. The lesson applies well beyond fork bombs: any runaway process tree, from a buggy script to a broken container, is contained the same way.

Try this

  1. Read the breakdown of :(){ :|:& };: one symbol at a time before you start the simulation.
  2. Press Start with no protection and watch the process count climb until it reaches the PID limit.
  3. Turn on the ulimit -u, cgroups or systemd protection, start again and see the process tree stop at 100.

Frequently asked questions

What does :(){ :|:& };: do?
It defines a function named : that calls itself twice, piping one copy into the other and running them in the background, then calls it. The number of processes doubles each round until the system cannot create more.
How do I protect a Linux system from a fork bomb?
Limit how many processes a user or service can create: ulimit -u or /etc/security/limits.conf for login users, pids.max in a cgroup, or TasksMax in a systemd unit. Containers can be limited with the pids limit of the runtime.
How do you stop a running fork bomb?
It is hard once the process table is full, because you may not be able to start kill or a new shell. If you still have a shell, killall with the process name or sending SIGSTOP and then SIGKILL to the user processes can work; often a reboot is the only option.

Try next

Sponsored
Carbon Ads
$ cd /games
// share