Add NetworkLimiter with bidirectional bandwidth limiting via tc integration by Copilot · Pull Request #4 · pmarchini/giogo

Copilot · 2026-02-07T01:36:33Z

Implementation Plan for NetworkLimiter - COMPLETED ✓

Summary

Successfully implemented bidirectional network bandwidth limiting with clean interface-based design, robust error handling, and comprehensive documentation:

✓ LifecycleLimiter interface - Optional Setup/Cleanup methods for limiters needing lifecycle management
✓ No special handling - Executor treats all limiters uniformly through interfaces
✓ Proper cleanup tracking - Only cleans up successfully initialized limiters
✓ Error recovery - Cleans up on setup failure in reverse order
✓ Input validation - Validates interface name before tc setup
✓ Egress bandwidth limiting - Direct HTB on main interface for outgoing traffic
✓ Ingress bandwidth limiting - IFB device redirection pattern for incoming traffic
✓ Bidirectional control - Both egress and ingress can be limited independently
✓ Formatted code - All test code properly formatted
✓ Comprehensive documentation - Detailed docs/network-limiter.md file

Documentation Highlights (docs/network-limiter.md):

Architecture explanation for egress and ingress patterns
Step-by-step implementation details
Complete tc command references
Usage examples and bandwidth units
Requirements and limitations
Debugging and troubleshooting guide
Performance considerations

Example usage:

# Egress only (outgoing traffic)
sudo giogo --network-class-id=100 --network-max-bandwidth=1m -- your_app

# Ingress only (incoming traffic)
sudo giogo --network-class-id=100 --network-max-bandwidth-ingress=500k -- your_app

# Bidirectional (both egress and ingress)
sudo giogo --network-class-id=100 --network-max-bandwidth=1m --network-max-bandwidth-ingress=500k -- your_app

Original prompt

This section details on the original issue you should resolve

<issue_title>Missing Network Limiter</issue_title>
<issue_description>It would be great to add a new NetworkLimiter to allow users to define network limits</issue_description>

Comments on the Issue (you are @copilot in this section)

Fixes Missing Network Limiter #3

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

Co-authored-by: pmarchini <[email protected]>

…erface support Co-authored-by: pmarchini <[email protected]>

pmarchini

I want to be able to set a defined max bandwidth

Copilot · 2026-02-07T01:47:24Z

I want to be able to set a defined max bandwidth

I'd like to clarify the requirement. The cgroups v2 network controller doesn't directly support bandwidth limiting - it only provides classID (for packet classification) and priority settings.

Network bandwidth limiting in Linux is typically achieved through:

Traffic Control (tc) using the classID we already support
eBPF programs for advanced traffic shaping
Other kernel mechanisms outside of cgroups

Are you looking for:

Integration with tc to automatically set bandwidth limits based on the classID?
Support for cgroup unified interface parameters (if any exist for bandwidth)?
A different approach?

Could you provide more details on your use case and preferred implementation approach?

pmarchini

What I’m looking for is integration with Traffic Control (tc) rather than a new kernel-level bandwidth controller.
Concretely, my requirement is:
assign processes/services to a cgroup
use the cgroup’s classID / packet classification
automatically attach those packets to a tc HTB/TBF class
enforce a configurable max bandwidth (rate/ceil)
So the expected behavior would be something like:
cgroup → automatic tc class → bandwidth limit enforced

- Add --network-max-bandwidth flag for setting bandwidth limits - Implement tc (traffic control) HTB setup and cleanup - Integrate tc lifecycle management in executor - Add comprehensive tests for bandwidth parsing - Update README with bandwidth limiting documentation Co-authored-by: pmarchini <[email protected]>

- Export GetDefaultInterface to avoid duplication - Use os.Stderr for warning messages in executor - Return cleanup errors instead of silently logging - Remove duplicate getDefaultInterface function Co-authored-by: pmarchini <[email protected]>

Copilot · 2026-02-07T02:01:30Z

What I’m looking for is integration with Traffic Control (tc) rather than a new kernel-level bandwidth controller.
Concretely, my requirement is:
assign processes/services to a cgroup...

Implemented! The feature now provides automatic tc integration exactly as requested:

cgroup → automatic tc class → bandwidth limit enforced

Added in commit 5ed595e:

--network-max-bandwidth flag (e.g., 1m, 500k)
Automatic HTB qdisc setup with cgroup filter
Configurable rate/ceil enforcement
Automatic cleanup on exit

Example:

sudo giogo --network-class-id=100 --network-max-bandwidth=1m -- your_app

The implementation:

Sets cgroup classID via network controller
Configures tc HTB qdisc on default interface
Creates cgroup filter to match packets
Enforces bandwidth limit with rate=ceil
Cleans up tc rules when process exits

All tests pass with no security vulnerabilities detected.

pmarchini · 2026-02-07T02:06:34Z

internal/executor/executor.go

+	executor := &Executor{
 		Limiters: limiters,
 	}
+
+	// Extract NetworkLimiter if present for special handling
+	for _, l := range limiters {
+		if netLimiter, ok := l.(*limiter.NetworkLimiter); ok {
+			executor.NetworkLimiter = netLimiter
+			break
+		}
+	}
+
+	return executor


We should not break the design having special handling here

Fixed in commit 595e495. Refactored to use LifecycleLimiter interface instead of special handling:

Added optional LifecycleLimiter interface with Setup/Cleanup methods

Executor uses type assertion to check for the interface

No special NetworkLimiter field or hardcoded logic

Any limiter can implement LifecycleLimiter if needed

The design now maintains clean separation of concerns with interface-based patterns.

pmarchini · 2026-02-07T02:06:47Z

internal/executor/executor.go

 	}

+	// Set up traffic control if network limiter with bandwidth is configured
+	if e.NetworkLimiter != nil && e.NetworkLimiter.MaxBandwidth > 0 {


Same as above

Fixed in commit 595e495. Removed all special handling by using the LifecycleLimiter interface pattern. The executor now treats all limiters uniformly through interfaces.

…Limiter handling - Add LifecycleLimiter interface with Setup/Cleanup methods - Implement Setup/Cleanup on NetworkLimiter - Remove special NetworkLimiter field from Executor - Use interface-based design for lifecycle management - Maintains clean separation of concerns Co-authored-by: pmarchini <[email protected]>

- Track successfully setup limiters separately - Cleanup only limiters that were successfully initialized - Cleanup in reverse order on error - Add interface name validation in Setup method Co-authored-by: pmarchini <[email protected]>

pmarchini

I want now to handle the incoming traffic too.

We can achieve it following this schema:

Redirect ingress → IFB → tc rules

- Add --network-max-bandwidth-ingress flag - Implement setupIngressHTB with IFB device redirection - Pattern: Redirect ingress → IFB → tc rules - Support bidirectional bandwidth control (egress + ingress) - Add comprehensive tests for ingress bandwidth - Update README with ingress examples Co-authored-by: pmarchini <[email protected]>

Copilot · 2026-02-07T02:41:48Z

I want now to handle the incoming traffic too.

We can achieve it following this schema:...

Implemented in commit 0584d41! The ingress traffic handling now follows the IFB pattern exactly as requested:

Redirect ingress → IFB → tc rules

Added --network-max-bandwidth-ingress flag that:

Loads IFB kernel module
Creates IFB device (ifb-{interface})
Redirects ingress traffic from main interface to IFB
Applies HTB rate limiting on IFB device
Automatic cleanup on exit

Example usage:

# Ingress only
sudo giogo --network-class-id=100 --network-max-bandwidth-ingress=500k -- app

# Bidirectional (egress + ingress)
sudo giogo --network-class-id=100 --network-max-bandwidth=1m --network-max-bandwidth-ingress=500k -- app

Both egress and ingress can be limited independently for full bidirectional bandwidth control.

pmarchini · 2026-02-07T03:52:52Z

internal/limiter/network_test.go

+
+// Helper function to create a pointer to uint32
+func uint32Ptr(v uint32) *uint32 {
+	return &v
+}
+
+func TestNewNetworkLimiterWithBandwidth(t *testing.T) {
+tests := []struct {
+name             string
+init             *limiter.NetworkLimiterInitializer
+wantMaxBandwidth uint64
+wantErr          bool
+}{
+{
+name: "valid bandwidth in kilobytes",
+init: &limiter.NetworkLimiterInitializer{
+ClassID:      "100",
+MaxBandwidth: "500k",
+},
+wantMaxBandwidth: 500 * 1024,
+wantErr:          false,
+},
+{
+name: "valid bandwidth in megabytes",
+init: &limiter.NetworkLimiterInitializer{
+ClassID:      "100",
+MaxBandwidth: "1m",
+},
+wantMaxBandwidth: 1024 * 1024,
+wantErr:          false,
+},
+{
+name: "valid bandwidth in gigabytes",
+init: &limiter.NetworkLimiterInitializer{
+ClassID:      "100",
+MaxBandwidth: "2g",
+},
+wantMaxBandwidth: 2 * 1024 * 1024 * 1024,
+wantErr:          false,
+},
+{
+name: "invalid bandwidth",
+init: &limiter.NetworkLimiterInitializer{
+ClassID:      "100",
+MaxBandwidth: "invalid",
+},
+wantErr: true,
+},
+{
+name: "bandwidth without classID should work",
+init: &limiter.NetworkLimiterInitializer{
+MaxBandwidth: "1m",
+},
+wantMaxBandwidth: 1024 * 1024,
+wantErr:          false,
+},
+}
+
+for _, tt := range tests {
+t.Run(tt.name, func(t *testing.T) {
+netLimiter, err := limiter.NewNetworkLimiter(tt.init)
+if (err != nil) != tt.wantErr {
+t.Errorf("NewNetworkLimiter() error = %v, wantErr %v", err, tt.wantErr)
+return
+}
+if tt.wantErr {
+return
+}
+
+if netLimiter.MaxBandwidth != tt.wantMaxBandwidth {
+t.Errorf("MaxBandwidth = %v, expected %v", netLimiter.MaxBandwidth, tt.wantMaxBandwidth)
+}
+})
+}
+}
+
+func TestNewNetworkLimiterWithIngressBandwidth(t *testing.T) {
+tests := []struct {
+name                    string
+init                    *limiter.NetworkLimiterInitializer
+wantMaxBandwidthIngress uint64
+wantErr                 bool
+}{
+{
+name: "valid ingress bandwidth",
+init: &limiter.NetworkLimiterInitializer{
+ClassID:             "100",
+MaxBandwidthIngress: "1m",
+},
+wantMaxBandwidthIngress: 1024 * 1024,
+wantErr:                 false,
+},
+{
+name: "both egress and ingress",
+init: &limiter.NetworkLimiterInitializer{
+ClassID:             "100",
+MaxBandwidth:        "500k",
+MaxBandwidthIngress: "1m",
+},
+wantMaxBandwidthIngress: 1024 * 1024,
+wantErr:                 false,
+},
+{
+name: "invalid ingress bandwidth",
+init: &limiter.NetworkLimiterInitializer{
+ClassID:             "100",
+MaxBandwidthIngress: "invalid",
+},
+wantErr: true,
+},
+}
+
+for _, tt := range tests {
+t.Run(tt.name, func(t *testing.T) {
+netLimiter, err := limiter.NewNetworkLimiter(tt.init)
+if (err != nil) != tt.wantErr {
+t.Errorf("NewNetworkLimiter() error = %v, wantErr %v", err, tt.wantErr)
+return
+}
+if tt.wantErr {
+return
+}
+
+if netLimiter.MaxBandwidthIngress != tt.wantMaxBandwidthIngress {
+t.Errorf("MaxBandwidthIngress = %v, expected %v", netLimiter.MaxBandwidthIngress, tt.wantMaxBandwidthIngress)
+}
+})
+}
+}


Format this code

Formatted in commit 0af5d28. Test tables now use proper indentation and alignment.

pmarchini · 2026-02-07T03:54:11Z

internal/limiter/network_tc.go

+
+// setupHTB sets up HTB (Hierarchical Token Bucket) qdisc for bandwidth limiting
+// It creates a root qdisc and a class with the specified rate limit
+func setupHTB(interfaceName string, classID uint32, rateBytesPerSec uint64) error {


Create a separated documentation markdown file for this specific limiter in order to explain how it works (both in ingress and egress)

Created in commit 0af5d28. Added docs/network-limiter.md with comprehensive documentation covering:

Architecture for egress and ingress patterns

Detailed explanations of how both work

tc command references

Usage examples and requirements

Implementation details and lifecycle

Limitations, debugging, and troubleshooting

- Format TestNewNetworkLimiterWithBandwidth and TestNewNetworkLimiterWithIngressBandwidth - Create docs/network-limiter.md with detailed documentation - Document egress and ingress traffic control patterns - Include architecture, usage examples, and implementation details - Add tc command references and troubleshooting guide Co-authored-by: pmarchini <[email protected]>

Initial plan

ce29fee

Copilot AI assigned Copilot and pmarchini Feb 7, 2026

Copilot started work on behalf of pmarchini February 7, 2026 01:36 View session

Copilot AI and others added 3 commits February 7, 2026 01:39

Add NetworkLimiter implementation with tests and CLI integration

5568305

Co-authored-by: pmarchini <[email protected]>

Update README with NetworkLimiter documentation and examples

c0dbecf

Co-authored-by: pmarchini <[email protected]>

Address code review feedback: improve network config handling and int…

6d71b93

…erface support Co-authored-by: pmarchini <[email protected]>

Copilot AI changed the title ~~[WIP] Add NetworkLimiter to define network limits~~ Add NetworkLimiter for cgroup network resource control Feb 7, 2026

Copilot AI requested a review from pmarchini February 7, 2026 01:43

Copilot finished work on behalf of pmarchini February 7, 2026 01:43