From 539dae613ea57227d8e80f4940d00a7c6a8a5d3d Mon Sep 17 00:00:00 2001 From: bluebluesoda <300733005+bluebluesoda@users.noreply.github.com> Date: Fri, 28 Aug 2026 09:58:09 +0000 Subject: [PATCH] feat(images): bake vpsmgr TCP tuning (BBR + buffers) into every image All image build scripts now append the TCP tuning sysctls to /etc/sysctl.conf and run sysctl -p (best-effort) during the build. Covers 50/eol-debian11/80 (Debian) and 60/70/90 (RHEL/openSUSE/Arch). --- scripts/50-image.sh | 16 ++++++++++++++++ scripts/60-rhel-image.sh | 16 ++++++++++++++++ scripts/70-opensuse-image.sh | 16 ++++++++++++++++ scripts/80-debian-dev-image.sh | 16 ++++++++++++++++ scripts/90-arch-image.sh | 16 ++++++++++++++++ scripts/eol-debian11-image.sh | 16 ++++++++++++++++ 6 files changed, 96 insertions(+) diff --git a/scripts/50-image.sh b/scripts/50-image.sh index 02bc4a0..06c1737 100755 --- a/scripts/50-image.sh +++ b/scripts/50-image.sh @@ -77,6 +77,22 @@ if [ -f /etc/systemd/network/eth0.network ]; then sed -i "s/^DHCP=true\$/DHCP=ipv4/" /etc/systemd/network/eth0.network printf "\n[IPv6AcceptRA]\nUseOnLinkPrefix=false\nUseRoutePrefix=false\nUseAutonomousPrefix=false\nDHCPv6Client=no\n" >> /etc/systemd/network/eth0.network fi +# vpsmgr TCP tuning: BBR congestion control, larger autotuned buffers, window +# scaling on, and no slow-start reset after idle (better for long-lived SSH and +# tunnel connections). Baked into /etc/sysctl.conf so it applies at container +# boot; sysctl -p is a best-effort apply during the build (an unprivileged +# container may deny net.* sysctls — that is non-fatal). +cat >> /etc/sysctl.conf </dev/null || true + # slim the published image: drop apt lists/archives and logs. Without this the # image balloons ~70MiB beyond just openssh (apt lists alone are ~50MiB). apt-get clean 2>/dev/null || true diff --git a/scripts/60-rhel-image.sh b/scripts/60-rhel-image.sh index cdef6f0..a1c055f 100755 --- a/scripts/60-rhel-image.sh +++ b/scripts/60-rhel-image.sh @@ -76,6 +76,22 @@ rpm -q openssh-server >/dev/null mkdir -p /etc/ssh/sshd_config.d printf "PermitRootLogin yes\nPasswordAuthentication yes\n" > /etc/ssh/sshd_config.d/99-vpsmgr.conf systemctl enable sshd +# vpsmgr TCP tuning: BBR congestion control, larger autotuned buffers, window +# scaling on, and no slow-start reset after idle (better for long-lived SSH and +# tunnel connections). Baked into /etc/sysctl.conf so it applies at container +# boot; sysctl -p is a best-effort apply during the build (an unprivileged +# container may deny net.* sysctls — that is non-fatal). +cat >> /etc/sysctl.conf </dev/null || true + # slim the published image: drop dnf caches and logs dnf clean all 2>/dev/null || true rm -rf /var/cache/dnf /var/log/* /tmp/* /var/tmp/* 2>/dev/null || true diff --git a/scripts/70-opensuse-image.sh b/scripts/70-opensuse-image.sh index 1fe7b6f..bf4ce7c 100644 --- a/scripts/70-opensuse-image.sh +++ b/scripts/70-opensuse-image.sh @@ -75,6 +75,22 @@ rpm -q openssh-server >/dev/null mkdir -p /etc/ssh/sshd_config.d printf "PermitRootLogin yes\nPasswordAuthentication yes\n" > /etc/ssh/sshd_config.d/99-vpsmgr.conf systemctl enable sshd +# vpsmgr TCP tuning: BBR congestion control, larger autotuned buffers, window +# scaling on, and no slow-start reset after idle (better for long-lived SSH and +# tunnel connections). Baked into /etc/sysctl.conf so it applies at container +# boot; sysctl -p is a best-effort apply during the build (an unprivileged +# container may deny net.* sysctls — that is non-fatal). +cat >> /etc/sysctl.conf </dev/null || true + # slim the published image: drop zypper caches and logs zypper clean --all 2>/dev/null || true rm -rf /var/cache/zypp /var/log/* /tmp/* /var/tmp/* 2>/dev/null || true diff --git a/scripts/80-debian-dev-image.sh b/scripts/80-debian-dev-image.sh index 3b356cc..4d03cbf 100755 --- a/scripts/80-debian-dev-image.sh +++ b/scripts/80-debian-dev-image.sh @@ -139,6 +139,22 @@ ln -sf /usr/local/go/bin/gofmt /usr/local/bin/gofmt ln -sf "${NODE_BIN_DIR}/node" /usr/local/bin/node ln -sf "${NODE_BIN_DIR}/npm" /usr/local/bin/npm ln -sf "${NODE_BIN_DIR}/npx" /usr/local/bin/npx +# vpsmgr TCP tuning: BBR congestion control, larger autotuned buffers, window +# scaling on, and no slow-start reset after idle (better for long-lived SSH and +# tunnel connections). Baked into /etc/sysctl.conf so it applies at container +# boot; sysctl -p is a best-effort apply during the build (an unprivileged +# container may deny net.* sysctls — that is non-fatal). +cat >> /etc/sysctl.conf </dev/null || true + # slim the published image: apt lists/archives, logs, nvm caches (.cache holds # the downloaded node tarballs; .git is the repo cloned by nvm installer), npm # and root caches. Without this the image balloons ~150MiB beyond the tools. diff --git a/scripts/90-arch-image.sh b/scripts/90-arch-image.sh index 0a6b47e..4418d3a 100755 --- a/scripts/90-arch-image.sh +++ b/scripts/90-arch-image.sh @@ -99,6 +99,22 @@ command -v sshd >/dev/null || { echo "sshd install failed" >&2; exit 1; } mkdir -p /etc/ssh/sshd_config.d printf "PermitRootLogin yes\nPasswordAuthentication yes\n" > /etc/ssh/sshd_config.d/99-vpsmgr.conf systemctl enable sshd +# vpsmgr TCP tuning: BBR congestion control, larger autotuned buffers, window +# scaling on, and no slow-start reset after idle (better for long-lived SSH and +# tunnel connections). Baked into /etc/sysctl.conf so it applies at container +# boot; sysctl -p is a best-effort apply during the build (an unprivileged +# container may deny net.* sysctls — that is non-fatal). +cat >> /etc/sysctl.conf </dev/null || true + # slim the published image: drop pacman caches (packages + sync dbs), logs. # A bare rm avoids the pacman -Scc interactive prompts in a non-tty exec. rm -rf /var/cache/pacman/pkg/* /var/lib/pacman/sync/* /var/log/* /tmp/* /var/tmp/* 2>/dev/null || true diff --git a/scripts/eol-debian11-image.sh b/scripts/eol-debian11-image.sh index d7b1a5e..42e6866 100644 --- a/scripts/eol-debian11-image.sh +++ b/scripts/eol-debian11-image.sh @@ -77,6 +77,22 @@ if [ -f /etc/systemd/network/eth0.network ]; then sed -i "s/^DHCP=true$/DHCP=ipv4/" /etc/systemd/network/eth0.network printf "\n[IPv6AcceptRA]\nUseOnLinkPrefix=false\nUseRoutePrefix=false\nUseAutonomousPrefix=false\nDHCPv6Client=no\n" >> /etc/systemd/network/eth0.network fi +# vpsmgr TCP tuning: BBR congestion control, larger autotuned buffers, window +# scaling on, and no slow-start reset after idle (better for long-lived SSH and +# tunnel connections). Baked into /etc/sysctl.conf so it applies at container +# boot; sysctl -p is a best-effort apply during the build (an unprivileged +# container may deny net.* sysctls — that is non-fatal). +cat >> /etc/sysctl.conf </dev/null || true + # slim the published image: drop apt lists/archives and logs. apt-get clean 2>/dev/null || true rm -rf /var/lib/apt/lists/* 2>/dev/null || true