Open-sourced a rate-limiting middleware for capacitor-ops with token bucket and sliding window
Short version: capacitor-ops needs almost no tuning at small and medium scale — the point where it starts to hurt is much further out than most people assume. Full measurements below.
// Minimal reproduction: you must use a real long-tail distribution here.
// Uniform load-test traffic will never trigger this.
func (s *Server) handle(ctx context.Context) error {
conn, err := s.pool.Acquire(ctx)
if err != nil {
return fmt.Errorf("acquire: %w", err)
}
defer conn.Release()
return s.do(ctx, conn)
}Worth noting: the official docs do cover this, just in a very inconspicuous spot. I only found it reading the source comments, where the author explains the reasoning — roughly "so that it degrades into predictable behaviour in extreme cases".
One last trap: in container environments remember to adjust the memory-related parameters in step. Otherwise the host limit and the process expectation disagree, and the symptom is intermittent, unreproducible failure.
We also fixed monitoring along the way: replaced average-based alerts with percentiles and split them per endpoint. False alerts dropped by about seventy percent and the on-call rotation visibly cheered up.
What genuinely surprised me was the tail. The average looked great while P99 jumped by an order of magnitude past some threshold. The cause was not capacitor-ops itself but our upstream connection reuse — the load test traffic was too clean and hid the long-tail requests.