Limit resources

Bound what one request may cost Gotenberg: its size, its time, its fan-out and its memory.

Size

• --api-body-limit caps the size of a request, such as 50MB. There is no limit by default. A larger request answers 413.
• --api-archive-max-entries, 10,000 by default, and --api-archive-max-ratio, 100 by default, bound what a ZIP under archives may unpack to, against ZIP bombs.

Time

• --api-timeout bounds each request, 30 seconds by default, queue included. A request past it answers 503.
• --webhook-client-timeout bounds each call to a webhook, 30 seconds by default.

Queues

--chromium-max-queue-size and --libreoffice-max-queue-size cap the requests waiting for an engine, unlimited by default. The next one answers 429, so a busy container sheds load instead of piling up timeouts.

Downloads

• --api-download-from-max-entries caps the URLs one downloadFrom lists, unlimited by default.
• --api-download-from-max-concurrency caps how many download at once, 10 by default.

PDF processing

litho, Gotenberg's PDF engine, bounds what one PDF may make it decode:

Flag	Default
--pdf-max-stream-bytes	256 MiB per stream
--pdf-max-image-pixels	100 million pixels
--pdf-max-embedded-file-bytes	50 MiB per embedded file read for validation

A stream or an image past its limit fails the stage with 400. An embedded file past its limit is left out of validation. --pdf-max-concurrency sets how many of a request's documents litho processes at once, one by default.

Next

Run in production sizes the engines and their restarts.