Workaround: Pasta does not play well with BBR congestion control

[m13253]

I noticed that pasta (Podman’s rootless network engine) does not play well with the bbr congestion control, and causes TCP stalls on outbound (send) directions, eventually resulting in timeouts.

$ pasta --version
pasta 0^20260611.ga9c61ff-1.fc44.x86_64

$ podman run --rm --sysctl net.ipv4.tcp_congestion_control=bbr -it docker.io/library/debian bash -i

root@<CONTAINER>:/# apt ...

root@<CONTAINER>:/# iperf3 -c <SERVER> --congestion bbr
Connecting to host <SERVER>, port 5201
[  5] local <LOCAL> port 60152 connected to <SERVER> port 5201
[ ID] Interval           Transfer     Bitrate         Retr  Cwnd
[  5]   0.00-1.00   sec   896 KBytes  7.33 Mbits/sec   49   89.8 KBytes
[  5]   1.00-2.00   sec  0.00 Bytes  0.00 bits/sec   66   75.6 KBytes
[  5]   2.00-3.00   sec  0.00 Bytes  0.00 bits/sec    0   75.6 KBytes
[  5]   3.00-4.00   sec  0.00 Bytes  0.00 bits/sec   54   77.0 KBytes
[  5]   4.00-5.00   sec  0.00 Bytes  0.00 bits/sec    0   77.0 KBytes
[  5]   5.00-6.00   sec  0.00 Bytes  0.00 bits/sec    0   77.0 KBytes
[  5]   6.00-7.00   sec  0.00 Bytes  0.00 bits/sec   55   75.6 KBytes
[  5]   7.00-8.00   sec  0.00 Bytes  0.00 bits/sec    0   75.6 KBytes
[  5]   8.00-9.00   sec  0.00 Bytes  0.00 bits/sec    0   75.6 KBytes
[  5]   9.00-10.00  sec  0.00 Bytes  0.00 bits/sec    0   75.6 KBytes
- - - - - - - - - - - - - - - - - - - - - - - - -
[ ID] Interval           Transfer     Bitrate         Retr
[  5]   0.00-10.00  sec   896 KBytes   734 Kbits/sec  224            sender
[  5]   0.00-10.19  sec   256 KBytes   206 Kbits/sec                  receiver

iperf Done.

Such TCP stall looks similar to an MTU issue, which may lead to people wasting hours exploring an incorrect path.

Here is the workaround. Put this to ~/.config/containers/containers.conf.d/tcp-cubic.conf

[containers]
default_sysctls = ["net.ipv4.tcp_congestion_control=cubic", {append=true}]

On some networks, you also need to lower the MTU. If that’s the case, put this to ~/.config/containers/containers.conf.d/mtu.conf

[network]
pasta_options = ["--mtu", "1500", {append=true}]

Note that lowering the MTU generally reduces pasta’s performance. But there are network environments where it is necessary.

I hope this can help people who come across a similar issue.

[Luap99]

cc @sbrivio-rh @dgibson