[randomizedcoder]

FP-5 of the focused hardening plan (#291), Phase F2: what one workload can cost the collector is bounded and counted.

Per-namespace caps

• -maxDumpBytes (default 256 MiB, MAX_DUMP_BYTES): bytes of one namespace's dump per poll. Packets past the cap are drained undecoded (handOff, shared by both receivers); NLMSG_DONE still ends the dump.
• -maxRecordsPerNetns (default 262144, MAX_RECORDS_PER_NETNS): records past the cap are dropped before decode. A per-packet budget from the receiver's existing header walk, so decoders compare a local counter, no shared atomics.
• -maxNetns (default 4096, MAX_NETNS): a tracked namespace keeps its slot until it dies; later ones wait first come, first served. Pid-rank eviction (630b117) was backed out: pids wrap, so a tenant could evict monitored workloads.

Socket-count gate (-maxRecordsPerPoll, default 1,048,576)

• Before each poll, read every namespace's sockstat (TCP inuse + tw) through an fd opened in the namespace next to its netlink socket. pread, or with -ioUring batches of -ioUringSockstatBatchSize (64) per io_uring_enter with IOSQE_ASYNC and -ioUringSockstatWorkers (4) io-wq threads; procfs reads can't be non-blocking (io_uring/rw.c:39-52).
• Over the budget, a max-min fair share degrades only heavy namespaces: first drop TIME_WAIT/SYN_RECV from idiag_states, then dump one of K port shards per poll (rotated by the gate's own poll count) (inet_diag bytecode, audited; no CAP_NET_ADMIN needed).
• Shard key is max(sport, dport) over the namespace's own ip_local_port_range (read through a per-namespace fd), so a busy listener spreads over every shard; 36-byte bytecode. The earlier (sport∈R) OR (dport∈R) put every accepted connection in one shard (82a598b).
• Sockstat can't see request sockets (SYN_RECV): a SYN flood is still bounded by -maxRecordsPerNetns.

Reconcile limits and per-owner quota

• -reconcileTimeout (1s) bounds the /proc scan; a timed-out scan deletes nothing. One scan takes in at most 4 × -maxNetns new namespaces but keeps reporting tracked and waiting ones, so deletes stay correct. -maxNetnsAddsPerReconcile (256).
• -maxNetnsPerOwner (64). Owner = cgroup path cut at the runtime's component, accepted only where runtimes put it; user.slice → the user's slice; else the first two components. Over-quota owners get no queue place.
• Names and owners (cgroup reads) only for namespaces being added; owners oldest waiter first, ≥ 64 per reconcile.

Metrics: xtcp_dump_dropped_total{reason}, xtcp_netns_dropped_total{reason="max_netns"|"owner_quota"|"add_rate"}, xtcp_poll_sockets, xtcp_poll_degraded_total{level}, xtcp_reconcile_incomplete_total{reason}. 0 turns each off; all startup-only (preserveCaps). RLIMIT_NOFILE warning at startup (4 fds per namespace: socket, origNs snapshot, sockstat, port range).

Tradeoffs to review

• A timed-out scan deletes nothing: dead namespaces keep slots while scans keep timing out (needs ~10⁵+ live pids). Deleting on "last-seen pid left" instead lets churn during a flood evict live monitored namespaces. TODO: age out after N timed-out reconciles.
• The scan cap is owner-agnostic: a flood earlier in /proc order can delay discovery of new namespaces (tracked ones are unaffected).
• Runtimes that don't name cgroups by container id: owner is the first two path components, so a process there can mint owners.

Kernel analysis: docs/kernel/inet-diag-all-netns.md — every per-namespace dump walks the host-wide TCP table (tcp_diag.c:325, net_eq skips at :350/:416/:501); where an all-namespace dump would go (Linux 7.3.0 @ 46fec1c3029b).

Also found: giouring v1.1.2 RegisterIOWQMaxWorkers([]uint) passes 64-bit values where the kernel reads __u32[2]; worked around here, fork fix TODO. xtcp2 requests only AF_INET, so IPv6 sockets are never dumped (TODO, own PR).

Tests (table-driven, P/N/B/C): sockstat parser and both readers on real fds (batch sizes, bad fds, out-of-order CQEs); EnqueueReadAt/IOWQ; fair share and plans with simulated 500k counts; shard bytecode over 500k pairs through xtcpnl's kernel model; the poll path end to end with the captured request run through that model; scan limits, owners (spoofed sub-cgroups), reconcile limits, quota, queue bound; caps through both receivers; Set preserving the caps; env overrides.

Benchmarks (24-core host):

• sockstat read: pread 3.2–3.6 µs/namespace, io_uring batch 64 1.8–2.0 µs (batch 1: 14.8 µs); 4096 namespaces: plan 199 µs, whole pre-pass 15.6 ms (pread); 0 allocs.
• Hot path vs the FP-5: dump/record/netns caps, socket-count gate, reconcile limits, per-owner quota #301 head (BenchmarkNetlinkerDump, 8 interleaved runs): geomean −1.5%, no row slower. A field first added above the pools shifted their cache lines and cost +5–10% at 4–8 decoders; moved to the struct tail.
• FP-5: dump/record/netns caps, socket-count gate, reconcile limits, per-owner quota #301 caps on vs off in one build: no significant row; geomean +0.6%.

Review fixes (109ff10): shard rotation counted poller events, not polls, so it could pin one shard; fd check missed the origNs fd. The thread-churn test (pre-existing on main) hit its 150-thread cap at GOMAXPROCS ≥ 64; now bounded and pinned.

VM: microvm-x86_64-lifecycle passes at 9af699d and 109ff10 (20 checks, drops=0, namespace add/delete, docker and anonymous namespaces).

Socket-scale VM (microvm-x86_64-socket-scale, 82a598b): OVERALL_PASS.

• Shared walk: a small namespace's ss takes 37 ms beside an empty neighbour, 143 ms beside 500k sockets on the shared table, 54 ms when the neighbour has its own (tcp_child_ehash_entries).
• Gate on (500k-socket namespace, budget 200k): sampled on 31 of 31 polls, 0 records dropped, RSS 51 → 48 MB, 15 threads. Gate off: 31 of 31 polls hit the per-namespace cap.
• SYN flood: sockstat misses SYN_RECV; the per-namespace cap holds.
• Namespace flood: one owner gets exactly 64 tracked (owner_quota drops counted), another owner's namespace still added; no reconcile timeouts; 141 threads, 46 MB RSS.
• sockfill now disables Go's default keepalive: ~33k probes/s at 500k connections reset idle ones during full dumps (test tool only).

🤖 Generated with Claude Code