Raise the runtime container soft nofile limit before supervisord starts so WebUI and managed services inherit a larger descriptor allowance.
Add an explicit compose nofile example, document the startup contract, and cover the limit raise and hard-limit cap with focused regression tests.
