In this lesson, you will learn how to enforce bandwidth ceilings on containerized workloads by manipulating the Linux Traffic Control (tc) subsystem directly at the virtual network interface level.
The Mechanism of Traffic Shaping
While container runtimes often provide high-level quotas, true kernel-level enforcement happens within the tc (Traffic Control) framework. When a container is attached to a bridge (like docker0) or a virtual Ethernet pair (veth), it generates packets that must traverse the kernel's network stack. By attaching a Token Bucket Filter (TBF) or Hierarchical Token Bucket (HTB) to the container's egress interface, we can force the kernel to buffer or drop packets that exceed a defined throughput, effectively throttling the container before it hits the host's physical network device.
Practical Enforcement
To enforce a 100Mbps limit on a specific container interface (e.g., veth1234), you interact with the kernel’s queuing disciplines (qdisc). The kernel acts as the arbiter, holding packets until the token bucket is replenished.
# Attach a TBF qdisc to the container's virtual interface
tc qdisc add dev veth1234 root tbf rate 100mbit burst 32kbit latency 400ms
In this configuration:
rate: Sets the maximum bandwidth.burst: Determines the amount of data that can be sent at line speed before the limit is enforced.latency: Defines how long a packet can sit in the kernel queue before being dropped.
By applying this at the veth level, the enforcement is invisible to the containerized application but strictly enforced by the kernel scheduler. This prevents a "noisy neighbor" from saturating the host's uplink, as the kernel handles the queuing discipline (qdisc) for every packet egressing that namespace. Because this is executed at the kernel interface layer, the container cannot bypass these limits, even with root privileges inside its own namespace, as the throttle is physically bound to the host-side representation of its network device.
Key Takeaway: Kernel-level rate limiting utilizes queuing disciplines on the virtual interface to enforce deterministic throughput boundaries, effectively preventing cross-container bandwidth starvation.