Design a VM bandwidth rate limiter that shapes per-VM traffic on a shared physical NIC

• Redistribute idle bandwidth to active VMs to prevent capacity waste during low contention
• Handle ingress and egress asymmetrically since incoming packets cannot be shaped upstream
• Make scheduling decisions in microseconds within the kernel hot path to avoid forwarding latency

• Hierarchical Token Bucket (HTB)
• Ingress policing at virtual switch
• Policy push via gRPC