feat(images): bake vpsmgr TCP tuning (BBR + buffers) into every image

All image build scripts now append the TCP tuning sysctls to
/etc/sysctl.conf and run sysctl -p (best-effort) during the build.
Covers 50/eol-debian11/80 (Debian) and 60/70/90 (RHEL/openSUSE/Arch).

scripts/50-image.sh

@@ -77,6 +77,22 @@ if [ -f /etc/systemd/network/eth0.network ]; then
   sed -i "s/^DHCP=true\$/DHCP=ipv4/" /etc/systemd/network/eth0.network
   printf "\n[IPv6AcceptRA]\nUseOnLinkPrefix=false\nUseRoutePrefix=false\nUseAutonomousPrefix=false\nDHCPv6Client=no\n" >> /etc/systemd/network/eth0.network
 fi
+# vpsmgr TCP tuning: BBR congestion control, larger autotuned buffers, window
+# scaling on, and no slow-start reset after idle (better for long-lived SSH and
+# tunnel connections). Baked into /etc/sysctl.conf so it applies at container
+# boot; sysctl -p is a best-effort apply during the build (an unprivileged
+# container may deny net.* sysctls — that is non-fatal).
+cat >> /etc/sysctl.conf <<SYSCTL
+
+# vpsmgr TCP tuning
+net.ipv4.tcp_congestion_control = bbr
+net.ipv4.tcp_rmem = 8192 262144 4194304
+net.ipv4.tcp_wmem = 4096 16384 4194304
+net.ipv4.tcp_window_scaling = 1
+net.ipv4.tcp_slow_start_after_idle = 0
+SYSCTL
+sysctl -p 2>/dev/null || true
+
 # slim the published image: drop apt lists/archives and logs. Without this the
 # image balloons ~70MiB beyond just openssh (apt lists alone are ~50MiB).
 apt-get clean 2>/dev/null || true

scripts/60-rhel-image.sh

@@ -76,6 +76,22 @@ rpm -q openssh-server >/dev/null
 mkdir -p /etc/ssh/sshd_config.d
 printf "PermitRootLogin yes\nPasswordAuthentication yes\n" > /etc/ssh/sshd_config.d/99-vpsmgr.conf
 systemctl enable sshd
+# vpsmgr TCP tuning: BBR congestion control, larger autotuned buffers, window
+# scaling on, and no slow-start reset after idle (better for long-lived SSH and
+# tunnel connections). Baked into /etc/sysctl.conf so it applies at container
+# boot; sysctl -p is a best-effort apply during the build (an unprivileged
+# container may deny net.* sysctls — that is non-fatal).
+cat >> /etc/sysctl.conf <<SYSCTL
+
+# vpsmgr TCP tuning
+net.ipv4.tcp_congestion_control = bbr
+net.ipv4.tcp_rmem = 8192 262144 4194304
+net.ipv4.tcp_wmem = 4096 16384 4194304
+net.ipv4.tcp_window_scaling = 1
+net.ipv4.tcp_slow_start_after_idle = 0
+SYSCTL
+sysctl -p 2>/dev/null || true
+
 # slim the published image: drop dnf caches and logs
 dnf clean all 2>/dev/null || true
 rm -rf /var/cache/dnf /var/log/* /tmp/* /var/tmp/* 2>/dev/null || true

scripts/70-opensuse-image.sh

@@ -75,6 +75,22 @@ rpm -q openssh-server >/dev/null
 mkdir -p /etc/ssh/sshd_config.d
 printf "PermitRootLogin yes\nPasswordAuthentication yes\n" > /etc/ssh/sshd_config.d/99-vpsmgr.conf
 systemctl enable sshd
+# vpsmgr TCP tuning: BBR congestion control, larger autotuned buffers, window
+# scaling on, and no slow-start reset after idle (better for long-lived SSH and
+# tunnel connections). Baked into /etc/sysctl.conf so it applies at container
+# boot; sysctl -p is a best-effort apply during the build (an unprivileged
+# container may deny net.* sysctls — that is non-fatal).
+cat >> /etc/sysctl.conf <<SYSCTL
+
+# vpsmgr TCP tuning
+net.ipv4.tcp_congestion_control = bbr
+net.ipv4.tcp_rmem = 8192 262144 4194304
+net.ipv4.tcp_wmem = 4096 16384 4194304
+net.ipv4.tcp_window_scaling = 1
+net.ipv4.tcp_slow_start_after_idle = 0
+SYSCTL
+sysctl -p 2>/dev/null || true
+
 # slim the published image: drop zypper caches and logs
 zypper clean --all 2>/dev/null || true
 rm -rf /var/cache/zypp /var/log/* /tmp/* /var/tmp/* 2>/dev/null || true

scripts/80-debian-dev-image.sh

@@ -139,6 +139,22 @@ ln -sf /usr/local/go/bin/gofmt /usr/local/bin/gofmt
 ln -sf "${NODE_BIN_DIR}/node" /usr/local/bin/node
 ln -sf "${NODE_BIN_DIR}/npm" /usr/local/bin/npm
 ln -sf "${NODE_BIN_DIR}/npx" /usr/local/bin/npx
+# vpsmgr TCP tuning: BBR congestion control, larger autotuned buffers, window
+# scaling on, and no slow-start reset after idle (better for long-lived SSH and
+# tunnel connections). Baked into /etc/sysctl.conf so it applies at container
+# boot; sysctl -p is a best-effort apply during the build (an unprivileged
+# container may deny net.* sysctls — that is non-fatal).
+cat >> /etc/sysctl.conf <<SYSCTL
+
+# vpsmgr TCP tuning
+net.ipv4.tcp_congestion_control = bbr
+net.ipv4.tcp_rmem = 8192 262144 4194304
+net.ipv4.tcp_wmem = 4096 16384 4194304
+net.ipv4.tcp_window_scaling = 1
+net.ipv4.tcp_slow_start_after_idle = 0
+SYSCTL
+sysctl -p 2>/dev/null || true
+
 # slim the published image: apt lists/archives, logs, nvm caches (.cache holds
 # the downloaded node tarballs; .git is the repo cloned by nvm installer), npm
 # and root caches. Without this the image balloons ~150MiB beyond the tools.

scripts/90-arch-image.sh

@@ -99,6 +99,22 @@ command -v sshd >/dev/null || { echo "sshd install failed" >&2; exit 1; }
 mkdir -p /etc/ssh/sshd_config.d
 printf "PermitRootLogin yes\nPasswordAuthentication yes\n" > /etc/ssh/sshd_config.d/99-vpsmgr.conf
 systemctl enable sshd
+# vpsmgr TCP tuning: BBR congestion control, larger autotuned buffers, window
+# scaling on, and no slow-start reset after idle (better for long-lived SSH and
+# tunnel connections). Baked into /etc/sysctl.conf so it applies at container
+# boot; sysctl -p is a best-effort apply during the build (an unprivileged
+# container may deny net.* sysctls — that is non-fatal).
+cat >> /etc/sysctl.conf <<SYSCTL
+
+# vpsmgr TCP tuning
+net.ipv4.tcp_congestion_control = bbr
+net.ipv4.tcp_rmem = 8192 262144 4194304
+net.ipv4.tcp_wmem = 4096 16384 4194304
+net.ipv4.tcp_window_scaling = 1
+net.ipv4.tcp_slow_start_after_idle = 0
+SYSCTL
+sysctl -p 2>/dev/null || true
+
 # slim the published image: drop pacman caches (packages + sync dbs), logs.
 # A bare rm avoids the pacman -Scc interactive prompts in a non-tty exec.
 rm -rf /var/cache/pacman/pkg/* /var/lib/pacman/sync/* /var/log/* /tmp/* /var/tmp/* 2>/dev/null || true

scripts/eol-debian11-image.sh

@@ -77,6 +77,22 @@ if [ -f /etc/systemd/network/eth0.network ]; then
   sed -i "s/^DHCP=true$/DHCP=ipv4/" /etc/systemd/network/eth0.network
   printf "\n[IPv6AcceptRA]\nUseOnLinkPrefix=false\nUseRoutePrefix=false\nUseAutonomousPrefix=false\nDHCPv6Client=no\n" >> /etc/systemd/network/eth0.network
 fi
+# vpsmgr TCP tuning: BBR congestion control, larger autotuned buffers, window
+# scaling on, and no slow-start reset after idle (better for long-lived SSH and
+# tunnel connections). Baked into /etc/sysctl.conf so it applies at container
+# boot; sysctl -p is a best-effort apply during the build (an unprivileged
+# container may deny net.* sysctls — that is non-fatal).
+cat >> /etc/sysctl.conf <<SYSCTL
+
+# vpsmgr TCP tuning
+net.ipv4.tcp_congestion_control = bbr
+net.ipv4.tcp_rmem = 8192 262144 4194304
+net.ipv4.tcp_wmem = 4096 16384 4194304
+net.ipv4.tcp_window_scaling = 1
+net.ipv4.tcp_slow_start_after_idle = 0
+SYSCTL
+sysctl -p 2>/dev/null || true
+
 # slim the published image: drop apt lists/archives and logs.
 apt-get clean 2>/dev/null || true
 rm -rf /var/lib/apt/lists/* 2>/dev/null || true