feat: strengthen resources rate-limiting

options.go

@@ -25,6 +25,19 @@ func getFirecrackerConfig() (firecracker.Config, error) {
 			PathOnHost:   firecracker.String("../agent/rootfs.ext4"),
 			IsRootDevice: firecracker.Bool(true),
 			IsReadOnly:   firecracker.Bool(false),
+			RateLimiter: firecracker.NewRateLimiter(
+				// bytes/s
+				models.TokenBucket{
+					OneTimeBurst: firecracker.Int64(1024 * 1024), // 1 MiB/s
+					RefillTime:   firecracker.Int64(500),         // 0.5s
+					Size:         firecracker.Int64(1024 * 1024),
+				},
+				// ops/s
+				models.TokenBucket{
+					OneTimeBurst: firecracker.Int64(100),  // 100 iops
+					RefillTime:   firecracker.Int64(1000), // 1s
+					Size:         firecracker.Int64(100),
+				}),
 		}},
 		NetworkInterfaces: []firecracker.NetworkInterface{{
 			// Use CNI to get dynamic IP
@@ -34,9 +47,9 @@ func getFirecrackerConfig() (firecracker.Config, error) {
 			},
 		}},
 		MachineCfg: models.MachineConfiguration{
-			VcpuCount:  firecracker.Int64(2),
+			VcpuCount:  firecracker.Int64(1),
 			HtEnabled:  firecracker.Bool(true),
-			MemSizeMib: firecracker.Int64(512),
+			MemSizeMib: firecracker.Int64(256),
 		},
 	}, nil
 }