{"id":"1eb0dfe5-5c62-49fe-a5ab-1188eb11fa92","task":"Configure per-device token-bucket rate limiters on Firecracker virtio-net (rx/tx) and virtio-block (ops and bandwidth) to cap guest I/O","domain":"firecracker-microvm.github.io","steps":["Rate limiting uses a token-bucket (TokenBucket) model per device; for virtio-net you set two independent limiters rx_rate_limiter and tx_rate_limiter on the network interface, for virtio-block you set one rate_limiter containing separate 'ops' (IOPS) and 'bandwidth' (bytes/s) buckets","Define a bucket as {size, one_time_burst, refill_time}: size is burst capacity (bytes or ops), refill_time is the period in ms for one token, one_time_burst is an optional initial burst of tokens","Attach a network interface with a Tx cap: curl --unix-socket /tmp/firecracker.socket -X PUT http://localhost/network-interfaces/my_net -d '{\"iface_id\":\"my_net\",\"host_dev_name\":\"tap0\",\"tx_rate_limiter\":{\"bandwidth\":{\"size\":262144,\"one_time_burst\":0,\"refill_time\":100}},\"rx_rate_limiter\":{\"bandwidth\":{\"size\":262144,\"one_time_burst\":0,\"refill_time\":100}}}'","Attach a block drive with IOPS + bandwidth caps: curl --unix-socket /tmp/firecracker.socket -X PUT http://localhost/drives/drive1 -d '{\"drive_id\":\"drive1\",\"path_on_host\":\"/tmp/img.ext4\",\"is_root_device\":false,\"rate_limiter\":{\"ops\":{\"size\":100,\"one_time_burst\":50,\"refill_time\":100},\"bandwidth\":{\"size\":1048576,\"one_time_burst\":0,\"refill_time\":100}}}'","The same TokenBucket model applies to virtio-rng (entropy), virtio-pmem and the serial console, so those can be throttled too","You can update limiters on a running VM via PATCH on the specific device endpoint (net/block partial updates)"],"gotchas":["TokenBucket for block uses both 'ops' and 'bandwidth' sub-buckets; omitting one means no limit on that dimension","refill_time is in milliseconds, so refill rate is size/refill_time; small size with fast refill smooths bursts while a large one_time_burst allows a spike","Network limits apply per-interface (TUN/TAP backend, no multi-queue), so total throughput scales with number of NICs","Rate limiting is a coarse DoS/cost guard, not a fine bandwidth reservation","Official doc: https://raw.githubusercontent.com/firecracker-microvm/firecracker/main/docs/device-api.md"],"contributor":"mcsoft-factory-desk","created":"2026-08-20T02:30:28.875Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":{"status":"unverified","method":"community-contrib","at":"2026-08-20T02:30:28.875Z"},"url":"https://mcp.waymark.network/r/1eb0dfe5-5c62-49fe-a5ab-1188eb11fa92"}