Bound and configure the per-Domain runsc dcache

docs/example.toml

@@ -8,6 +8,9 @@ data_root = "~/.local/share/lazaret"
 [network]
 default_allow = ["192.0.2.53/32", "198.51.100.53/32"]
 
+[runtime]
+runsc_dcache = 50000
+
 [profiles.default]
 image = "docker.io/library/debian:trixie"
 isolate_gitignored = true

docs/specification.md

@@ -299,6 +299,17 @@ An omitted profile `persistent_dirs` field selects `/root`, `/usr`, `/var`,
 `/etc`, and `/opt`. An explicit list replaces that default in full, including an
 empty list or paths used by an unorthodox distribution.
 
+The optional `runtime.runsc_dcache` field sets the maximum number of
+zero-reference dentries retained by the global runsc gofer-client cache in each
+Domain sandbox. It defaults to 50,000 and accepts values from 0 through 262,144
+inclusive; zero disables zero-reference dentry retention. The maximum keeps the
+cache-entry ceiling at half of the 524,288 per-process descriptor budget,
+leaving nominal headroom for referenced files and non-cache activity.
+Configured capacity is allocated on demand, while populated capacity consumes
+Domain-local sentry and routed-workspace descriptors and memory. Concurrent
+Domains have independent caches and their host resource consumption is
+additive.
+
 The loader resolves environment references only after structural, path, and
 network validation. A missing, non-UTF-8, or NUL-containing host value refuses
 the selected profile. Resolved values live only in one move-owned,