Add docker workflow alongside host mode

[pgray]

Adds a docker workflow for boar without disturbing the existing host workflow. Toidiu's scripts/virt_*.sh netns chain stays the default; docker mode is opt-in via --mode docker.

Usage

make docker-up                              # one-shot: build, server up, client run, tear down
make docker-server                          # leave server detached
make docker-run ARGS="-d 50mb -c 5"         # iterate on the client side

Existing host workflow keeps working via make build / make run.

Topology

Two containers on a user-defined bridge instead of the 6-namespace chain.

┌─ boar-server ─┐    docker bridge     ┌─ boar-client ─┐
│ async_http3   │◄──── veth ─────────► │ quiche-client │
│ :9999         │  (tc/netem on        │  + boar       │
└───────────────┘   client eth0)       └───────────────┘

Server lifecycle is owned by docker, not boar. Shaping is applied on the client's eth0 ingress via IFB so it lands on the download path — semantically equivalent to the legacy netem-on-ns_m2 hop.

What's in

• Dockerfile (rust:1-trixie + iproute2/ethtool/tc tooling + BoringSSL build deps). BuildKit cache mounts for cargo registry/git and both target dirs; binaries materialized to /opt/boar/bin so they survive the cache mount being unmounted.
• docker-compose.yml — two services on boar-net, NET_ADMIN on the client for tc/ifb, bind-mount ./reports, HOST_UID/HOST_GID env so output files land owned by the host user.
• scripts/docker_tc.sh — eth0 ingress redirect → ifb0 with htb (rate) + netem (delay/loss); eth0 egress = fq.
• scripts/docker_tc_cleanup.sh — idempotent teardown.
• scripts/docker_entrypoint.sh — EXIT trap chowns /boar/reports back to the host user; configurable readiness sleep.
• src/mode.rs — Mode { Host, Docker }, default Host. Plumbed through EndpointSetup and args::parse.
• src/args.rs — --mode, --server-host flags; DNS-resolves the hostname to an IP because quiche-client's --connect-to does a bare SocketAddr::parse and panics on hostnames.
• src/endpoint.rs — run_server returns Option and is None in docker mode (server lives in a peer container); run_client drops the netns wrap.
• src/network.rs — adds a cleanup_cmd field so docker mode can actually tear down qdiscs (host mode keeps the legacy no-op test.sh).
• src/stats/delivery_rate.rs — fail-soft like DownloadDuration. No more unwrap-panic when the client fails to download.
• src/main.rs — handles the optional server handle; dumps client_logs to stderr when either parser misses a pattern.
• Makefile — make help lists test/build/run (host) and docker-* (docker).
• reports/ instead of report/.

Host prereqs for docker mode

sudo modprobe ifb sch_netem
git submodule update --init

Known caveats

• --cc-algorithm is label-only in docker mode. Boar no longer starts the server, so the CCA is configured at compose time via BOAR_SERVER_CCA env. Per-run CCA control would need either a control-plane RPC into the server container or docker.sock access — left as a follow-up.
• StartupExit is NaN in docker mode. The metric used to be built from the server's in-process stderr; now the server is in a peer container. Recovering it cleanly means a shared log volume — TODO in main.rs.
• Server readiness is a 2s sleep, not a real probe. There's no clean HTTP/3 healthcheck.

[pgray]

heya @toidiu I loved your talk at SRUG

I added some docker stuff in case you want it.

no pressure at all and just trying to help out.

I'll add some more context around where you could go with injecting packet loss.