Guard against high ulimit -n in when starting vnc (#2058)

* Guard against high `ulimit -n` when starting vnc

Recent versions of docker in combination with the upstream systemd
unit files pass an incredibly high `ulimit -n` to the docker container, up
to 1 billion. That causes minute high delays and CPU spinning when
connecting to VNC while it enumerates all the file descriptors.

See #2045

* Update failure message

* Allow the ulimit to be configurable by env

NodeBase/start-vnc.sh

@@ -44,6 +44,17 @@ if [ "${START_XVFB:-$SE_START_XVFB}" = true ] ; then
       echo "Waiting for Xvfb..."
     done
 
+    # Guard against unreasonably high nofile limits. See https://github.com/SeleniumHQ/docker-selenium/issues/2045
+    if [[ $(ulimit -n) -gt 200000 || ! -z "${SE_VNC_ULIMIT}" ]]; then
+      echo "Trying to update the open file descriptor limit from $(ulimit -n) to ${SE_VNC_ULIMIT:-65536}."
+      ulimit -n ${SE_VNC_ULIMIT:-65536}
+      if [ $? -eq 0 ]; then
+        echo "Successfully update the open file descriptor limit."
+      else
+        echo "The open file descriptor limit could not be updated."
+      fi
+    fi
+
     x11vnc ${X11VNC_OPTS} -forever -shared -rfbport ${VNC_PORT:-$SE_VNC_PORT} -rfbportv6 ${VNC_PORT:-$SE_VNC_PORT} -display ${DISPLAY}
   else
     echo "VNC won't start because SE_START_VNC is false."

README.md

@@ -1169,6 +1169,8 @@ If you want to run VNC without password authentication you can set the environme
 
 If you want to run VNC in view-only mode you can set the environment variable `SE_VNC_VIEW_ONLY=1`.
 
+If you want to modify the open file descriptor limit for the VNC server process you can set the environment variable `SE_VNC_ULIMIT=4096`.
+
 ### Using your browser (no VNC client is needed)
 
 This project uses [noVNC](https://github.com/novnc/noVNC) to allow users to inspect visually container activity with