This limit can prevent from running out of disk space by any one of applications inside the container using "dd if=/dev/zero of=/attack bs=1M", since "docker run" already supports this options.