frank-large: halogen container cutover, rootless rlimit law, and the DFlash2 drafter shape

scripts/serve-frank-large.sh

@@ -110,14 +110,19 @@ done
 LOG="${FRANK_LARGE_LOG:-/home/dank/logs/frank_large.log}"
 mkdir -p "$(dirname "$LOG")"
 # for the udev-granted supplementary group, seccomp unconfined for the ROCm
-# ioctl surface, and unbounded memlock/nofile (the engine mmaps 33.4 GiB of
-# weights and wants a big fd budget). No comment lines inside the backslash
+# ioctl surface, and unbounded memlock (the unit's LimitMEMLOCK=infinity is
+# inherited, so runc never has to RAISE it). NO --ulimit nofile: Dankclaw's
+# hard limit is 524288, rootless runc cannot raise a hard limit and dies
+# with "error setting rlimit type 7: operation not permitted" (measured
+# 2026-10-05 cutover), and 524288 fds is already ~100x what the engine
+# wants; the model card and both sibling serve scripts pass no nofile
+# either. No comment lines inside the backslash
 # chain — a mid-chain # terminates the continuation (the 2026-10-05
 # exit-127 crash loop on the sibling serve script).
 podman run -d --name "$FRANK_LARGE_CONTAINER" \
   --publish "$FRANK_LARGE_PUBLISH" \
   --ipc=host \
-  --ulimit memlock=-1:-1 --ulimit nofile=1048576:1048576 \
+  --ulimit memlock=-1:-1 \
   --device "$DEV_KFD" --device "$DEV_DRI" \
   --group-add keep-groups \
   --security-opt seccomp=unconfined \