In this lesson, you will learn how to enforce bandwidth limits on container-specific virtual interfaces using the Linux Traffic Control (tc) subsystem to ensure fair network resource distribution.
The Mechanism of Traffic Shaping
When multiple containers reside on the same host, a single "noisy neighbor" can saturate the physical NIC, causing latency for all other services. Since containers communicate via veth pairs (which act as virtual wires between the container namespace and the host bridge), we can apply tc rules directly to these interfaces to throttle egress traffic.
The most common approach for simple rate-limiting is using the Token Bucket Filter (TBF) discipline. TBF shapes traffic by enforcing a maximum data rate, allowing for short bursts while ensuring the average throughput remains below your specified threshold.
Implementing a Limit
Suppose your container’s host-side interface is named veth123. To limit this specific interface to 10 Mbps, you would issue the following commands on the host:
# Add a TBF qdisc to the egress of the veth interface
tc qdisc add dev veth123 root handle 1: tbf \
rate 10mbit burst 32kbit latency 400ms
Here is the breakdown of the command:
rate 10mbit: The sustained bandwidth limit.burst 32kbit: The amount of data that can be sent at the line speed before the limit kicks in.latency 400ms: The maximum time a packet can sit in the buffer before being dropped if the rate is exceeded.
Applying Fairness
By isolating these limits to the veth interface, you ensure that even if a container attempts to burst to 1Gbps, the host kernel intercepts the traffic and queues it at the virtual wire level. This prevents the packet queue from saturating the physical host interface. Because these tc disciplines are attached to the interface, they remain scoped strictly to the container's namespace egress, providing a predictable, fair environment for multi-tenant applications.
Key Takeaway: By applying a Token Bucket Filter (TBF) to the host-side veth interface, you can effectively police container bandwidth, preventing localized network congestion from impacting the host and other containerized services.