Fork Bomb.

A fork bomb is malicious or accidental code that spawns child processes recursively, doubling on each cycle until kernel limits, memory, or CPU are saturated and the system becomes unresponsive. The classic POSIX one-liner :(){ :|:& };: defines a function named : that pipes two copies of itself into the background and then invokes it; each generation doubles the process count, so the process table fills within seconds. The idea long predates Unix — one of its earliest names is the "wabbit" or rabbit program, reportedly seen on a University of Washington Burroughs mainframe around 1969-1974.

Fork bombs do not propagate over networks like worms; they are local resource-exhaustion attacks, but very effective on shared multi-user hosts, CI runners and containers, where a single unprivileged user can deny service to everyone.

Defences cap the resources a process tree may consume rather than blocking the syscall. On Linux the key controls are ulimit -u / PAM pam_limits (nproc) to bound per-user processes, and the cgroups pids controller (pids.max) — which Docker and Kubernetes expose via --pids-limit — to cap a container's task count. Account isolation, untrusted-code sandboxes and dedicated CI executors contain the blast radius further.

flowchart TD
  A[":() function<br/>calls itself twice"] --> B[Child 1]
  A --> C[Child 2]
  B --> D[Grandchild]
  B --> E[Grandchild]
  C --> F[Grandchild]
  C --> G[Grandchild]
  D --> H["... exponential growth ..."]
  E --> H
  F --> H
  G --> H
  H --> I{"pids.max / ulimit -u<br/>reached?"}
  I -->|No limit| J[Process table exhausted — host hangs]
  I -->|Limit set| K[New forks fail with EAGAIN — host survives]