Few failures feel as alarming as a shell that answers every command with fork: retry: Resource temporarily unavailable — you can't even run the tools you'd use to fix it. The system is out of process slots: either a runaway is spawning children endlessly, or a nproc limit is too low.
Get a foothold
When you can't fork new processes, lean on shell builtins (which don't fork) and already-open sessions. echo /proc/[0-9]* and bash's built-in printf can list PIDs without spawning anything.
# count processes per user to find the offender (from an existing session): ps -eo user= | sort | uniq -c | sort -rn | head # kill the runaway tree once identified: pkill -9 -f forkbomb
Stop it recurring
A single misbehaving user or service shouldn't be able to take down the whole box. Cap the per-user process count with a drop-in in /etc/security/limits.d/:
# /etc/security/limits.d/90-nproc.conf * soft nproc 1024 * hard nproc 2048 root - nproc unlimited
This is a different resource ceiling from memory (see the OOM killer) and from open file descriptors — don't confuse nproc with nofile.
Practise it
PID exhaustion is one of the simulator's nastier Linux incidents — the trap is needing to fix it without being able to launch new processes. Drill it in Linux troubleshooting practice.