Documentation
¶
Overview ¶
Package shaping applies per-container network egress rate limits using Linux traffic control (tc), entered through the container's network namespace with nsenter. It is image-independent: it uses the HOST's tc/nsenter against the container's netns (by init PID), so it works regardless of what the customer's image contains, and a tenant with dropped capabilities cannot remove it. On non-Linux dev builds every call is a no-op.
The host must give the agent the privilege to enter a netns and run tc (CAP_SYS_ADMIN + CAP_NET_ADMIN, granted as ambient capabilities on the agent's systemd unit) and have iproute2 (tc) + util-linux (nsenter) installed.
British English throughout. No em dashes.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func Apply ¶
Apply sets an egress ceiling of bytesPerSecond on the container whose init process is pid, by replacing the root qdisc on its eth0 with a token-bucket filter (tbf). Idempotent (uses `replace`). A non-positive rate clears the cap instead.
Types ¶
This section is empty.
Source Files