Aim is to limit Memory/CPU/IOps used by applications which can negatively impact whole system (typically: browsers, PDF readers, etc). This recipe uses systemd.

  1. Identify the slice/scope of the application to be limited: systemctl status --user (note --user is essential)
  2. Create a drop-in directory which matches the prefix of the app by stripping down to a hyper. So for example the directory ~/.config/systemd/user/app-flatpak-com.microsoft.Edge-.scope.d will match app-flatpak-com.microsoft.Edge-1467020954.scope
  3. Create a file with extension .conf and contents like: 
    [Scope]
MemoryAccounting=yes
MemoryHigh=1G
CpuWeight=20
  4. Reload the user systemd daemon: 
    systemctl --user daemon-reload
  5. Restart app and check the drop-in file has been applied, e.g.:
bnikolic@localhost:~> systemctl status --user  app-flatpak-com.microsoft.Edge-2281978514.scope
● app-flatpak-com.microsoft.Edge-2281978514.scope
     Loaded: loaded (/run/user/1000/systemd/transient/app-flatpak-com.microsoft.Edge-2281978514.scope; transient)
  Transient: yes
    Drop-In: /home/bnikolic/.config/systemd/user/app-flatpak-com.microsoft.Edge-.scope.d
             └─lims.conf
     Active: active (running) since Mon 2025-09-15 18:40:25 BST; 9min ago
 Invocation: 98741402fb7f401abad8eaa097d8b585
      Tasks: 96 (limit: 37972)
        CPU: 1min 15.192s
     CGroup: /user.slice/user-1000.slice/user@1000.service/app.slice/app-flatpak-com.microsoft.Edge-2281978514.scope
             ├─61723 /usr/bin/bwrap --args 41 -- /app/bin/edge
             ├─61732 /usr/bin/bwrap --args 41 -- /usr/bin/xdg-dbus-proxy --args=43
             ├─61733 /usr/bin/xdg-dbus-proxy --args=43
             ├─61736 /usr/bin/bwrap --args 41 -- /app/bin/edge
             ├─61737 "/app/extra/msedge --enable-features=WebRTCPipeWireCapturer --disable-features=WebAssemblyTrapHandler,DesktopPWAsRunOnOs>
             ├─61760 /app/extra/msedge_crashpad_handler --monitor-self --monitor-self-annotation=ptype=crashpad-handler "--database=/home/bni>
             ├─61762 /app/extra/msedge_crashpad_handler --no-periodic-tasks --monitor-self-annotation=ptype=crashpad-handler "--database=/hom>
             ├─61767 "/app/extra/msedge --type=zygote --no-zygote-sandbox --crashpad-handler-pid=17 --enable-crash-reporter=, --change-stack->
             ├─61771 cat
             ├─61772 cat
             ├─61813 "/app/extra/msedge --type=gpu-process --crashpad-handler-pid=17 --enable-crash-reporter=, --change-stack-guard-on-fork=e>
             ├─61819 "/app/extra/msedge --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=no>
             └─63214 "/app/extra/msedge --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-GB --service-sandbox-type=none ->

Sep 15 18:40:25 localhost.localdomain systemd[2111]: Started app-flatpak-com.microsoft.Edge-2281978514.scope.
lines 1-25/25 (END)
  1. Check the right limit has been applied:
bnikolic@localhost:~> systemctl show --user  app-flatpak-com.microsoft.Edge-2281978514.scope | grep EffectiveMem
EffectiveMemoryMax=33369288704
EffectiveMemoryHigh=1073741824

References