[ericcurtin]

Summary

SSH relays and service forwards now have separate per-sandbox budgets, so open forwards no longer block SSH.

Related Issue

Closes #4472

Changes

• Count service forwards apart from SSH relays.
• Add max_ssh_connections_per_sandbox and max_service_connections_per_sandbox gateway settings (default 20, minimum 1).
• Name the exhausted budget in the limit error.
• Document the settings.

Release Notes

SSH and service forward connections have separate per-sandbox limits, both configurable in the gateway config.

Testing

• Checks appropriate to the affected code and behavior pass
• Unit tests added/updated (if applicable)
• E2E tests added/updated (if applicable)

cargo fmt, cargo clippy -D warnings, and lib tests for core and server pass.

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated (if applicable)

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[ericcurtin]

@krishicks @matthewgrossman could you please triage #4472 so the issue check can pass? @drew @mrunalp PTAL, and /ok to test b45de0c976a6c096daee7732424760a073b54894 if it looks good. Thank you!

[ericcurtin]

@johntmyers @TaylorMutch could you please triage #4472 so the issue check can pass? PTAL, and /ok to test b45de0c976a6c096daee7732424760a073b54894 if it looks good. Thank you!

[ericcurtin]

@FrostGod @pimlock PTAL when you get a chance, and could you please triage #4472 so the issue check can pass? /ok to test b45de0c976a6c096daee7732424760a073b54894 if it looks good. Thank you!

[TaylorMutch]

/ok to test b45de0c

[github-actions]

Compatibility review (advisory)

New or updated breaking changes; see the full report for all findings.

1. api-behavior — No explicit risk acceptance found

ForwardTcp replaces the shared 20-relay sandbox ceiling with independent default ceilings of 20 SSH relays and 20 service forwards.

• Impact: Existing gateway deployments lose their documented aggregate ceiling: after 20 service forwards, another SSH relay now succeeds instead of returning RESOURCE_EXHAUSTED.
• Action: Preserve the shared 20-relay ceiling by default in v0.1.7 and make independent budgets an explicit opt-in.
• PR: fix(server): budget SSH relays and service forwards separately #5063

Review details

• Execution: complete
• Candidate: PR #5063 (c852f16dd356d1f59f2449e86637d80abeb0906c)
• Baseline: 3a5dfcd2f1afd9c7376b07b11036265bbb68453c (3a5dfcd2f1afd9c7376b07b11036265bbb68453c)
• Reviewed: rust-sdk, python-sdk, go-sdk, typescript-sdk, api-behavior, cli, configuration, policy, helm, state

Advisory review; publication gates are unchanged.

Branch check run

[TaylorMutch]

Reviewed the separate SSH and service-forward budgets, configuration validation, token-count rollback, and connection-guard cleanup. No actionable code faults found. Focused accounting checks and PR CI pass.