Set the nofile ulimit for the slave container to 1024:1048576

It seems that on the Bullseye slave container (not sure about Buster),
the nofile ulimit is set to 1048576:1048576 (as in, 1048576 for both the
soft and hard limit). However, the Docker startup script in version 25
and newer sets the hard limit to 524288 (because of
moby/moby#c8930105b), which fails because then the soft limit will be
higher than the hard limit, which doesn't make sense.  However, on a
Bookworm slave container, the nofile ulimit is set to
1024:1048576, and the startup script's ulimit command goes through.

A simple workaround would be to explicitly set the nofile ulimit to be
1024:1048576 for all slave containers. However, sonic-swss's tests needs
more than 1024 file descriptors open, because the test code doesn't
clean up file descriptors at the end of each test case/test suite. This
results in FD leaks.

Therefore, set the ulimit to 524288:1048576, so that Docker's startup
script can lower it to 524288 and swss can open file descriptors.

Signed-off-by: Saikrishna Arcot <sarcot@microsoft.com>

Makefile.work

@@ -299,6 +299,8 @@ ifeq ($(DOCKER_BUILDER_WORKDIR),)
 override DOCKER_BUILDER_WORKDIR := "/sonic"
 endif
 
+# Consider removing the --ulimit flag once nothing older
+# than Bullseye is being used as a slave container.
 DOCKER_RUN := docker run --rm=true --privileged --init \
     -v $(DOCKER_BUILDER_MOUNT) \
     -v "$(DOCKER_LOCKDIR):$(DOCKER_LOCKDIR)" \
@@ -307,6 +309,7 @@ DOCKER_RUN := docker run --rm=true --privileged --init \
     -e "https_proxy=$(https_proxy)" \
     -e "no_proxy=$(no_proxy)" \
     -i$(shell { if [ -t 0 ]; then echo t; fi }) \
+    --ulimit nofile=524288:524288 \
     $(SONIC_BUILDER_EXTRA_CMDLINE)
 
 # Mount the $(DOCKER_ROOT) to /var/lib/docker in the slave container, the overlay fs is not supported as dockerd root folder.