Use tc to throttle Docker container's outgoing network bandwidth

Question

I'm trying to do the bandwidth throttling to the Docker containers. To limit the downlink bandwidth, I can first find the veth interface of the container and use tc: tc qdisc add dev vethpair1 root tbf rate 1mbit latency 50ms burst 10000. If I want to limit the uplink bandwidth, I need to specify --cap-add=NET_ADMIN when I spin up the container and use the same tc command on eth0 inside the container. Is there any non-intrusive way to do it, so that I can administrate any container without giving it privilege?

Eigenvalue

Answer 1

You could tell Docker to use LXC under the hoods : use the -e lxcoption.

Create your containers with a custom LXC directive to put them into a **traffic class** :

`docker run --lxc-conf="lxc.cgroup.net_cls.classid = 0x00100001" your/image /bin/stuff` 

Check the official documentation about how to apply bandwidth limits to this class.

Note : the --storage-driver=devicemapperand -e lxcoptions are for the Docker daemon, not for the Docker client you're using when running docker run ........

ALso you can do this through this:

mkdir /var/run/netns
ln -sf /proc/`docker inspect -f '{{ .State.Pid }}' YOUR_CONTAINER`/ns/net /var/run/netns/SOME_NAME
ip netns exec SOME_NAME iptables -L -nv

Insert

Thanks. I've tried net_cls but it didn't work. Is it because I didn't use LXC abstraction? I'll try LXC later. – Eigenvalue