Q: Your high-throughput API gateway running in Docker handles 50,000 concurrent HTTP/WebSocket connections. During traffic surges, clients experience connection drops. Kernel logs show `TCP: request_sock_TCP: Possible SYN flooding on port 80. Dropping request`. The Linux default `net.core.somaxconn` (128) and `net.ipv4.tcp_max_syn_backlog` (512) are bottlenecking socket acceptance. You must tune container sysctl parameters without compromising host kernel stability or violating security policies.

Understand Linux kernel sysctl classification: Namespaced sysctls are isolated to the container's network or IPC namespace (e.g., `net.*` and `kernel.msg*`). Modifying them only affects that specific container. Non-namespaced sysctls (e.g., `vm.max_map_count`, `fs.file-max`) affect the entire host OS kernel and all running containers.

<!-- Sysctl Scope -->
Namespaced (Safe per container):
  ├── net.core.somaxconn (Socket listen backlog)
  ├── net.ipv4.tcp_max_syn_backlog (SYN queue size)
  └── net.ipv4.ip_local_port_range (Ephemeral port range)

Global / Non-Namespaced (Host-wide, requires privileged access):
  ├── vm.max_map_count (Required for Elasticsearch)
  └── fs.file-max (Total system open file limits)

Pass namespaced sysctl parameters using `--sysctl` in `docker run` or the `sysctls` key in Docker Compose.

# Docker CLI invocation with optimized network buffers
docker run -d \
  --name api-gateway \
  --sysctl net.core.somaxconn=65535 \
  --sysctl net.ipv4.tcp_max_syn_backlog=65535 \
  --sysctl net.ipv4.tcp_tw_reuse=1 \
  --sysctl net.ipv4.ip_local_port_range="1024 65535" \
  -p 80:80 \
  nginx:alpine

# Docker Compose configuration:
# services:
#   gateway:
#     image: nginx:alpine
#     sysctls:
#       - net.core.somaxconn=65535
#       - net.ipv4.tcp_max_syn_backlog=65535

For databases like Elasticsearch that require global sysctls like `vm.max_map_count=262144`, avoid running the container as privileged. Use a privileged `initContainer` or node-level DaemonSet to set the sysctl on the host once at boot.

# InitContainer setting host sysctl safely before main container starts
initContainers:
  - name: init-sysctl
    image: busybox:musl
    command: ["sysctl", "-w", "vm.max_map_count=262144"]
    securityContext:
      privileged: true

Inspect `/proc/sys/net/core/somaxconn` inside the running container and monitor `netstat -s` for listen queue overflows (`times the listen queue of a socket overflowed`).

# Check active sysctl value inside container
docker exec -it api-gateway cat /proc/sys/net/core/somaxconn
# Output: 65535

# Verify listen queue drop counters
docker exec -it api-gateway netstat -s | grep -i overflow