rosotacom-dev 2.5.dev49__tar.gz → 2.5.dev51__tar.gz

{rosotacom_dev-2.5.dev49 → rosotacom_dev-2.5.dev51}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: rosotacom-dev
-Version: 2.5.dev49
+Version: 2.5.dev51
 Summary: Host CLI for ROS OTA communication sessions.
 Author: develNor
 License-Expression: BSD-3-Clause

{rosotacom_dev-2.5.dev49 → rosotacom_dev-2.5.dev51}/docs/findings/README.md

@@ -28,6 +28,8 @@ living verification hook.
 
 ## Findings
 
+- [A lost keyframe silences exactly the next gop_size−2 deltas](keyframe-loss-kills-the-next-deltas.md) - libavcodec emits nothing for them, the last delta decodes with artifacts, the next keyframe restores clean decode; a lost delta never blocks decode — so the display hole is gop_size × frame period, deterministically.
+- [Oversubscription queues — it does not lose until the queue itself dies](oversubscription-queues-not-losses.md) - 16% over an emulated cap climbed one-way delay 340 → 3250 ms across twelve bins with zero loss in every one; the losses arrived only when the queue died, all at once.
 - [Best-effort reordering becomes reader-side loss, independent of history depth](reorder-becomes-reader-loss.md) - under pure delay jitter a Cyclone best-effort reader discards every overtaken sample (57% at 100 Hz under 50+-45 ms), delivery stays strictly monotonic, and depth 50 loses the same as depth 1.
 - [Jitter causes loss while bandwidth shortage builds latency](jitter-loss-bandwidth-latency.md) - 18 KB at 20 Hz separates jitter-induced loss from bandwidth-induced queueing.
 - [Lighter alternating messages can lose more than steady messages](lighter-message-loss.md) - a 1x18KB+1x0KB pattern lost under a tight emulated profile while the steady 18 KB comparison did not.

{rosotacom_dev-2.5.dev49 → rosotacom_dev-2.5.dev51}/docs/findings/delay-alone-no-loss.md

@@ -54,13 +54,20 @@ rosotacom benchmark capacity --project src/rosotacom/resources/examples/rosotaco
 Migrated summary: 400 expected, 400 delivered, 0 lost, max p95 latency
 306.927 ms.
 
+Field recurrence (2026-08-17 CCNG drive): the negative control held on a real
+cellular link — five jam episodes ran one-way delay up to 401–459 ms with zero
+losses, and the drive's soggy last minute held p90 ≈ 138 ms at 0.04 losses/s.
+The positive counterpart (where the delay actually comes from when a link is
+too slow rather than too far) is
+[oversubscription-queues-not-losses.md](oversubscription-queues-not-losses.md).
+
 Verification: manual: run the commands above from a source checkout with Docker
 and `tc` privileges; this is a no-loss negative-control finding rather than a
 must-fail boundary row, so it remains outside the RFC 0007 boundary gate.
 
 ## Status
 
-confirmed, 2026-06-29.
+confirmed, 2026-08-18.
 
 ## Publication notes
 

{rosotacom_dev-2.5.dev49 → rosotacom_dev-2.5.dev51}/docs/findings/head-of-line-irregularity.md

@@ -45,13 +45,23 @@ The mechanism is visible only per message: the stream carrying alternating
 heavy/light samples can lose more than the steady stream despite lower mean
 payload bandwidth.
 
+Field recurrence (2026-08-17 CCNG drive): the DELAY half of the mechanism
+recurred and was measured per message — a small message with more than 30 KB
+in flight ahead of it paid +17.4 ms p50 / +67 ms p90, a small message sent
+within 40 ms after a video keyframe paid p50 42.1 vs 28.4 ms, and 18.4% of
+cross-topic pairs sent within 2 ms flipped order after a >20 KB first message.
+The LOSS half (delayed-then-overwritten) did not trigger there: it needs a
+queue tight against the offered load, and that link had ~14 Mbit/s
+serialization headroom at 2.5 Mbit/s offered. Both halves stay reproducible
+with the tight profile above.
+
 Verification: manual: run the two commands above from a source checkout with
 Docker and `tc` privileges; automation waits for the RFC 0007 regression matrix
 row for patterned loads because the public row registry does not exist yet.
 
 ## Status
 
-confirmed, 2026-07-02.
+confirmed, 2026-08-18.
 
 ## Publication notes
 

rosotacom_dev-2.5.dev51/docs/findings/keyframe-loss-kills-the-next-deltas.md

@@ -0,0 +1,69 @@
+# A Lost Keyframe Silences Exactly The Next gop_size−2 Deltas
+
+## Claim
+
+In a best-effort libx264 stream (ABR, `tune: zerolatency`, fixed GOP), losing
+a KEYFRAME makes exactly the next `gop_size − 2` arrived deltas undecodable —
+libavcodec emits **no frame at all** for them — the last delta before the next
+keyframe decodes with concealment artifacts, and the next keyframe restores
+clean decode. Losing a DELTA never blocks decode: every following access unit
+still produces a frame (artifacts until the next keyframe, never a gap). The
+behaviour is deterministic — not timing, not decoder state noise — so the
+display hole a keyframe loss tears is `gop_size × frame_period`, which is what
+makes the GOP length the knob that decides whether one lost packet crosses an
+operator-visible threshold.
+
+## Setup
+
+- Host pair / topology: single host, single process, below rosotacom at the
+  codec layer — encode with PyAV/libx264 exactly as the ffmpeg transport does,
+  delete single access units explicitly, feed the survivors to a fresh
+  libavcodec h264 decoder (what a best-effort receiver does after a loss).
+- rosotacom SHA: measured at `73fa1de`; re-runs record theirs.
+- Profile: none — no network is involved; the deletion IS the loss, which is
+  what makes the rule attributable to the codec rather than the transport.
+- Seed policy: deterministic synthetic motion clip, `n=1` (the assertions are
+  exact-set comparisons, not statistics).
+
+## Evidence
+
+Evidence grade: scripted single-host reproduction, committed next to this file.
+
+```bash
+python3 docs/findings/repro/decode_chain_repro.py --gop 5   # needs: pip install av numpy
+```
+
+2026-08-18 runs (synthetic clip, libx264 1 Mbit/s ABR, zerolatency, 10 Hz):
+
+| gop | deleted | silent AUs after it | first output after the gap |
+|---|---|---|---|
+| 5 | keyframe | exactly 3 (= gop−2) | last delta of the GOP, with artifacts |
+| 3 | keyframe | exactly 1 (= gop−2) | last delta of the GOP, with artifacts |
+| 2 | keyframe | none (= gop−2 = 0) | the following delta, with artifacts |
+| any | one delta | none | every AU keeps decoding, artifacts to next KF |
+
+The same rule was first measured on real field material (2026-08-17 CCNG
+drive, camera FFMPEGPacket stream at gop 5: every lost keyframe silenced the
+next 3 arrived deltas, ~400 ms holes at 10 Hz; a `refs=1` encode does NOT
+shorten the chain — tested and rejected). The synthetic clip reproduces it
+exactly, so the public repro carries the claim without any private bag.
+
+Verification: manual: run the command above (per `--gop 5`, `--gop 3`,
+`--gop 2`); the script asserts the exact silent set and exits non-zero on any
+deviation.
+
+## Status
+
+confirmed, 2026-08-18.
+
+## Publication notes
+
+This is the quantitative bridge from "loss percent" to "operator-visible
+hole": camera loss numbers mean nothing next to costmap loss numbers until
+multiplied by the GOP geometry. It drove the 2026-08-17 field configuration
+change gop 5 → 3 (hole ≤ 300 ms at equal measured bitrate). For papers: plot
+hole duration vs GOP at fixed measured bitrate, and state that intra-refresh
+trades the hole for a several-frame artifact window instead (no silent AUs,
+lower clean-frame share). See also
+[docs/ffmpeg-keyframes.md](../ffmpeg-keyframes.md) for reading keyframe flags
+out of recorded transit records.

rosotacom_dev-2.5.dev51/docs/findings/oversubscription-queues-not-losses.md

@@ -0,0 +1,81 @@
+# Oversubscription Queues — It Does Not Lose Until The Queue Itself Dies
+
+## Claim
+
+Offered load slightly above a rate cap turns entirely into queueing delay, not
+loss: one-way delay climbs by hundreds of milliseconds per second of
+oversubscription — into the seconds — while per-bin loss stays exactly zero.
+Loss appears only when the queue itself is destroyed (in emulation: a
+shape-changing timeline step; in the field: a bearer/modem reset), and then it
+is the whole backlog at once. Consequences: loss statistics alone certify a
+badly broken link as healthy, delay-based failure precedes loss-based failure,
+and a recovering link replays a burst of stale messages unless a lifespan
+bounds them.
+
+## Setup
+
+- Host pair / topology: rosotacom local benchmark mode using the packaged
+  example project, synthetic `bench_1_1_capacity` session, one
+  `a->b:/bench_capacity` stream, uplink shaping only (tc inside the peer
+  containers' own netns — no host privileges).
+- rosotacom SHA: measured at `73fa1de`; public re-runs record the current
+  checkout SHA in `result.json.context`.
+- Profile: `field-20260817-case3-delay-jam` in
+  [`src/rosotacom/resources/examples/profiles.yaml`](../../src/rosotacom/resources/examples/profiles.yaml)
+  — 10 s clean, 15 s `rate: 900kbit` (the crunch), 20 s clean; fitted to the
+  2026-08-17 CCNG drive's case3 window (in-flight queueing to 1.4 s at almost
+  no loss).
+- Seed policy: no stochastic netem elements (rate/delay only), `n=1`.
+
+## Evidence
+
+Evidence grade: packaged-profile benchmark run plus per-bin timeline.
+
+```bash
+rosotacom benchmark probe --project src/rosotacom/resources/examples/rosotacom.yaml --profile field-20260817-case3-delay-jam --size-pattern 1x13KB --rate-hz 10 --duration 45 --repeats 1 --no-plot
+```
+
+2026-08-18 run (offered 1.04 Mbit/s against the 15 s 900 kbit crunch — 16%
+oversubscription): twelve consecutive 1 s bins during the crunch show p95
+one-way latency climbing 340 → 601 → 880 → 1117 → 1420 → 1684 → 1944 → 2208 →
+2469 → 2704 → 3009 → **3250 ms with `lost = 0` in every single bin** — the
+queue (netem child, default limit 1000 packets) absorbs the entire excess.
+All 27 lost messages (5.9% of the run) sit in the three bins at the
+crunch→clean boundary, where the timeline step replaces a tbf+netem tree with
+a netem-only tree and the queued ~2.7 s backlog dies with the old queue.
+
+Two readings beyond the headline: (a) a loss-based health verdict over the
+crunch window reads "0% loss" while the operator's picture is three seconds
+old and aging — delay-based failure criteria fire long before loss-based
+ones; (b) the backlog-drop at the boundary is the emulated twin of a bearer
+reset, and it is also the caveat's edge: `tc qdisc replace` steps are seamless
+only between same-shape trees — a step that adds or removes `rate` swaps the
+tree and drops its queue.
+
+Field recurrence (2026-08-17 CCNG drive): five jam episodes with one-way
+delay 401–459 ms at zero losses; the case3 window queued to 1.4 s in-flight
+with almost no loss; and the drive's last minute ran p90 ≈ 138 ms delay at
+0.04 losses/s — the same regime at lower intensity. A 2026-08-18 container
+replay of a 9% oversubscription reached 3.66 s delay at exactly 0% loss.
+
+Verification: manual: run the command above from a source checkout with
+Docker; read the per-bin `time-bins.jsonl` next to `result.json` — the crunch
+bins must show monotonically climbing latency at zero loss, with the losses
+(if any) confined to the boundary bins.
+
+## Status
+
+confirmed, 2026-08-18.
+
+## Publication notes
+
+This is the mechanism behind
+[delay-alone-no-loss.md](delay-alone-no-loss.md)'s negative control seen from
+the other side: delay alone does not lose, and oversubscription alone does not
+lose either — it defers. Pair with
+[reorder-becomes-reader-loss.md](reorder-becomes-reader-loss.md) for the two
+ways "the network was fine, loss says so" misleads. For papers: plot per-bin
+delay and loss on one timeline; the visual is a delay ramp under a flat zero
+loss line, ending in a loss spike exactly when the queue dies. Lifespan QoS
+(and its enforcement gap — writer-side only in CycloneDDS) decides what the
+recovery burst does to the application.

rosotacom_dev-2.5.dev51/docs/findings/repro/decode_chain_repro.py

@@ -0,0 +1,126 @@
+#!/usr/bin/env python3
+"""Reproduce the keyframe decode-chain rule of a best-effort libx264 stream.
+
+Encodes a deterministic synthetic motion clip the way the ffmpeg transport
+does (libx264, ABR, ``tune: zerolatency``, fixed GOP), then deletes single
+access units and feeds the survivors to a fresh libavcodec h264 decoder --
+which is exactly what a best-effort receiver does after a network loss.
+
+Measured rule (docs/findings/keyframe-loss-kills-the-next-deltas.md):
+
+* delete a KEYFRAME  -> the next ``gop_size - 2`` arrived deltas produce NO
+  output at all, the last delta before the next keyframe decodes with
+  concealment artifacts, the next keyframe restores clean decode;
+* delete a DELTA     -> every following access unit still decodes (artifacts
+  until the next keyframe, never a gap).
+
+Usage (needs ``pip install av numpy``; no network, no privileges)::
+
+    python3 docs/findings/repro/decode_chain_repro.py [--gop 5] [--frames 40]
+
+Prints the per-AU decode table for both deletions and exits non-zero if the
+rule above does not hold.
+"""
+
+from __future__ import annotations
+
+import argparse
+import sys
+from fractions import Fraction
+
+import av
+import numpy as np
+
+
+def synthetic_frames(count: int, width: int = 320, height: int = 240):
+    """Deterministic motion: drifting background plus a moving block."""
+    for index in range(count):
+        image = np.full((height, width, 3), (index * 3) % 200, dtype=np.uint8)
+        x = (index * 7) % (width - 40)
+        image[60:180, x : x + 40] = 255
+        frame = av.VideoFrame.from_ndarray(image, format="rgb24")
+        yield frame.reformat(format="yuv420p")
+
+
+def encode(gop: int, count: int) -> list[tuple[bytes, bool]]:
+    codec = av.CodecContext.create("libx264", "w")
+    codec.width, codec.height = 320, 240
+    codec.pix_fmt = "yuv420p"
+    codec.framerate = Fraction(10, 1)
+    codec.bit_rate = 1_000_000
+    codec.options = {"tune": "zerolatency", "g": str(gop)}
+    packets: list[tuple[bytes, bool]] = []
+    for frame in synthetic_frames(count):
+        for packet in codec.encode(frame):
+            packets.append((bytes(packet), bool(packet.is_keyframe)))
+    for packet in codec.encode(None):
+        packets.append((bytes(packet), bool(packet.is_keyframe)))
+    return packets
+
+
+def decode_survivors(packets: list[tuple[bytes, bool]], deleted: set[int]) -> list[tuple[int, int]]:
+    """Feed every surviving AU to a fresh decoder; return (au_index, frames_out)."""
+    decoder = av.CodecContext.create("h264", "r")
+    out: list[tuple[int, int]] = []
+    for index, (payload, _kf) in enumerate(packets):
+        if index in deleted:
+            continue
+        try:
+            frames = decoder.decode(av.Packet(payload))
+        except av.error.InvalidDataError:
+            frames = []
+        out.append((index, len(frames)))
+    return out
+
+
+def main() -> int:
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("--gop", type=int, default=5)
+    parser.add_argument("--frames", type=int, default=40)
+    args = parser.parse_args()
+
+    packets = encode(args.gop, args.frames)
+    kf_indices = [i for i, (_p, kf) in enumerate(packets) if kf]
+    if len(kf_indices) < 3:
+        print("clip too short to delete a mid-stream keyframe", file=sys.stderr)
+        return 2
+
+    baseline = decode_survivors(packets, set())
+    silent_baseline = [i for i, n in baseline if n == 0]
+
+    failures: list[str] = []
+
+    # --- delete the second keyframe -------------------------------------
+    kf = kf_indices[1]
+    next_kf = kf_indices[2]
+    rows = decode_survivors(packets, {kf})
+    silent = [i for i, n in rows if n == 0 and i not in silent_baseline]
+    deltas_in_gap = [i for i in range(kf + 1, next_kf)]
+    expected_silent = deltas_in_gap[: max(0, args.gop - 2)]
+    print(f"deleted keyframe AU {kf} (gop {args.gop}, next keyframe {next_kf})")
+    print(f"  silent AUs: {silent}")
+    print(f"  expected  : {expected_silent} (the next gop_size-2 deltas)")
+    if silent != expected_silent:
+        failures.append(f"keyframe deletion: silent AUs {silent} != expected {expected_silent}")
+    resumed = [i for i, n in rows if i >= next_kf and n == 0]
+    if resumed:
+        failures.append(f"decode did not resume at the next keyframe: silent {resumed}")
+
+    # --- delete one delta ------------------------------------------------
+    delta = kf_indices[1] + 1
+    rows = decode_survivors(packets, {delta})
+    silent = [i for i, n in rows if n == 0 and i not in silent_baseline]
+    print(f"deleted delta AU {delta}")
+    print(f"  silent AUs: {silent} (must be empty -- artifacts, never a gap)")
+    if silent:
+        failures.append(f"delta deletion silenced AUs {silent}; expected none")
+
+    if failures:
+        print("FINDING VIOLATED:", *failures, sep="\n  ", file=sys.stderr)
+        return 1
+    print("ok: keyframe loss silences exactly the next gop_size-2 deltas; delta loss silences nothing")
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main())

{rosotacom_dev-2.5.dev49 → rosotacom_dev-2.5.dev51}/docs/rfcs/0004-network-profiles.md

@@ -266,6 +266,17 @@ risk — a stuck `qdisc` silently corrupts every later result on the machine.
   and outage steps, plus static distillation from a full trace or window
   (`trace_profiles.convert_trace_to_profile_yaml`). Passive throughput is omitted
   as `rate` unless the sample is marked saturated/probed/capacity-like.
+- [x] Shape without host sudo (issue #279): `--sudo-mode container` runs every
+  tc/ip argv in a short-lived `docker run --rm --network host --cap-add
+  NET_ADMIN` container on the peer, so docker-group membership is the whole
+  privilege. `--network host` keeps the target identical to the sudo modes
+  (the host netns is the netns the OTA com containers use); the safety
+  watchdog detaches as `docker run -d` under a fixed name and replaces a
+  stale predecessor at arm time; the image is `--shaping-image` or resolved
+  on the peer (running `rosotacom_` container's image, else the newest local
+  `ros-communication*` image, else an actionable exit-69). The lab benchmark
+  path needed none of this — it has always armed tc inside the peer
+  containers' own netns (`--cap-add NET_ADMIN` on the isolated network).
 - [ ] Confirm the `/proc/net/dev` link sampler (RFC 0003 / `link_bytes.py`) reports
   post-shaping wire bytes so link-overhead stays meaningful under a profile. *(Bench
   check.)*
@@ -342,6 +353,13 @@ off during implementation). Notes whether automation is feasible; privileged
   load generated YAML through `load_profiles_file`, and feed the resulting
   timeline into dry-run `ProfileShaper` command generation
   (`tests/unit/test_trace_profiles.py`). Done.
+- [x] **Sudo-free container shaping** (`--sudo-mode container`) — host unit tests
+  pin the generated shell: host-netns + NET_ADMIN on every tc/ip run, the
+  watchdog's `docker run -d` detachment and stale-predecessor replacement, the
+  on-peer image resolution with its actionable failure, and that the watchdog
+  name stays out of the `rosotacom_` conflict scan
+  (`tests/unit/test_container_shaping.py`). Arming it against a live remote pair
+  stays a bench check (same standing as the sudo modes' live half).
 - [ ] **Emulated-profile gate (rung 2)** — an example session run under one
   canonical profile in the per-promotion CI smoke, asserting a conditional bound
   that differs from the unshaped run. Automatable in the smoke matrix.

{rosotacom_dev-2.5.dev49 → rosotacom_dev-2.5.dev51}/src/rosotacom/cli.py

@@ -121,7 +121,15 @@ EXTERNAL_SESSION_CONTAINER_DIR = "/session/current"
 # `anonymize_bag.py` two thousand lines below already does it this way.
 RUN_SESSION_CONTAINER_ARGV = ("python3", "/ws/session/creation/run_session.py")
 DEFAULT_SMOKE_SESSION = "1_heartbeat"
-OTA_SUDO_MODES = ("passwordless", "askpass")
+# How profile shaping obtains tc/ip privileges on a peer. `passwordless` and
+# `askpass` are the two sudo shapes. `container` needs no sudo at all: every
+# tc/ip argv runs in a short-lived `docker run --rm --network host --cap-add
+# NET_ADMIN` container on the peer, so docker-group membership is the whole
+# privilege — the mode that makes profiles runnable on a machine that has
+# Docker but no passwordless sudo (issue #279). `--network host` puts tc in
+# the host netns, which is the netns the OTA com containers use, so it shapes
+# exactly the interface sudo would.
+OTA_SUDO_MODES = ("passwordless", "askpass", "container")
 
 # How ota-smoke puts rosotacom on each peer.
 #
@@ -2663,6 +2671,59 @@ def _sudo_command(argv: Sequence[str], *, askpass: bool = False) -> str:
     return f"{mode} {shlex.join(list(argv))}"
 
 
+#: Deterministic name for the container-mode safety watchdog on a peer. Fixed
+#: (not per-run) on purpose: arming replaces a stale predecessor with
+#: `docker rm -f`, so a crashed run's watchdog cannot accumulate — and the
+#: dash spelling keeps it out of the `rosotacom_` conflict scan, whose signal
+#: for a live run is the qdisc itself, not the sleeping watchdog.
+_SHAPING_WATCHDOG_NAME = "rosotacom-shaping-watchdog"
+
+
+def _shaping_image_resolution(image: str | None) -> str:
+    """Shell preamble that leaves the shaping image in ``$img`` on the peer.
+
+    An explicit image wins. Otherwise resolve on the peer itself, because the
+    scoped image name (`<base>-<install_id>`) is a property of the peer's own
+    install that the orchestrator cannot know before that install ran: prefer
+    the image of a running `rosotacom_` container, fall back to the newest
+    local `ros-communication*` image. Exit 69 with an actionable message when
+    neither exists (a machine that never ran rosotacom): shaping needs *an*
+    image with iproute2, and the com image is the one guaranteed relevant."""
+    if image:
+        return f"img={shlex.quote(image)}; "
+    return (
+        "img=\"$(docker ps --filter name=rosotacom_ --format '{{.Image}}' | head -n1)\"; "
+        '[ -n "$img" ] || img="$(docker image ls --format \'{{.Repository}}:{{.Tag}}\''
+        " | grep -m1 '^ros-communication' || true)\"; "
+        '[ -n "$img" ] || { echo "no shaping image on this peer: run rosotacom here once'
+        ' (any smoke/start builds the com image) or pass --shaping-image" >&2; exit 69; }; '
+    )
+
+
+def _container_shaping_command(argv: Sequence[str], *, image: str | None, watchdog: bool = False) -> str:
+    """One privileged tc/ip argv as a short-lived NET_ADMIN container run.
+
+    ``--network host`` is the point: the ephemeral container shares the host
+    netns, so ``tc`` acts on the same interface sudo would — but the privilege
+    comes from docker-group membership instead of a sudoers entry. A watchdog
+    argv (``sh -c 'sleep …; tc …'``) runs detached (``-d``) under the fixed
+    name above, replacing any stale predecessor; docker itself keeps it alive
+    across an orchestrator crash, which is the fail-safe RFC 0004 demands."""
+    argv = list(argv)
+    resolve = _shaping_image_resolution(image)
+    run = "docker run --rm --network host --cap-add NET_ADMIN"
+    if watchdog:
+        run = (
+            f"docker rm -f {_SHAPING_WATCHDOG_NAME} >/dev/null 2>&1 || true; "
+            f"docker run -d --rm --name {_SHAPING_WATCHDOG_NAME} --network host --cap-add NET_ADMIN"
+        )
+    if len(argv) >= 3 and argv[0] == "sh" and argv[1] == "-c":
+        tail = f'--entrypoint sh "$img" -c {shlex.quote(str(argv[2]))}'
+    else:
+        tail = f'--entrypoint {shlex.quote(argv[0])} "$img" {shlex.join(argv[1:])}'
+    return f"{resolve}{run} {tail}"
+
+
 def _passwordless_watchdog_command(argv: Sequence[str]) -> str:
     argv = list(argv)
     if len(argv) >= 3 and argv[0] == "sh" and argv[1] == "-c":
@@ -2744,6 +2805,7 @@ def _ota_preflight(
     require_network_shaping_sudo: bool = False,
     sudo_mode: str = OTA_DEFAULT_SUDO_MODE,
     sudo_passwords: Mapping[str, str] | None = None,
+    shaping_image: str | None = None,
     check_conflicts: bool = True,
 ) -> None:
     sudo_mode = _validate_ota_sudo_mode(sudo_mode)
@@ -2771,6 +2833,27 @@ def _ota_preflight(
         )
         _ota_run(peer, "docker ps >/dev/null", label=f"{peer.name}: docker access", dry_run=dry_run, batch=True)
         if require_network_shaping_sudo:
+            if sudo_mode == "container":
+                # tc/ip live in the shaping image, not on the host, and no sudo
+                # is involved: the one thing to prove is that a NET_ADMIN
+                # host-netns container can run and sees the tools. This also
+                # fails early — with the actionable exit-69 message — on a
+                # machine that has no candidate image yet.
+                _ota_run(
+                    peer,
+                    _container_shaping_command(
+                        [
+                            "sh",
+                            "-c",
+                            "command -v tc >/dev/null && command -v ip >/dev/null && tc qdisc show >/dev/null",
+                        ],
+                        image=shaping_image,
+                    ),
+                    label=f"{peer.name}: containerized network shaping (docker run, NET_ADMIN, tc in image)",
+                    dry_run=dry_run,
+                    batch=True,
+                )
+                continue
             _ota_run(
                 peer,
                 "command -v tc >/dev/null 2>&1 && command -v ip >/dev/null 2>&1",
@@ -3241,13 +3324,21 @@ def _ota_resolve_interfaces(peer: OtaSmokePeer, peer_addr: str, *, dry_run: bool
 
 
 def _peer_command_runner(
-    peer: OtaSmokePeer, *, dry_run: bool, sudo_password: str | None = None
+    peer: OtaSmokePeer,
+    *,
+    dry_run: bool,
+    sudo_password: str | None = None,
+    sudo_mode: str = OTA_DEFAULT_SUDO_MODE,
+    shaping_image: str | None = None,
 ) -> Callable[[Sequence[str]], None]:
     """A CommandRunner that runs one privileged argv on ``peer`` via the SSH path."""
 
     def run(argv: Sequence[str]) -> None:
         label = f"{peer.name}: tc/netem"
-        if sudo_password is None:
+        if sudo_mode == "container":
+            script = _container_shaping_command(argv, image=shaping_image)
+            _ota_run(peer, script, label=label, dry_run=dry_run)
+        elif sudo_password is None:
             script = _sudo_command(argv)
             _ota_run(peer, script, label=label, dry_run=dry_run)
         else:
@@ -3265,12 +3356,23 @@ def _peer_command_runner(
 
 
 def _peer_watchdog_launcher(
-    peer: OtaSmokePeer, *, dry_run: bool, sudo_password: str | None = None
+    peer: OtaSmokePeer,
+    *,
+    dry_run: bool,
+    sudo_password: str | None = None,
+    sudo_mode: str = OTA_DEFAULT_SUDO_MODE,
+    shaping_image: str | None = None,
 ) -> Callable[[Sequence[str]], None]:
     """Launch the safety-watchdog argv detached on ``peer`` so it survives a crash."""
 
     def launch(argv: Sequence[str]) -> None:
-        if sudo_password is None:
+        if sudo_mode == "container":
+            # `docker run -d` is the detachment: the daemon owns the sleeping
+            # watchdog, so it survives the SSH session, the orchestrator, and
+            # every rosotacom container on the machine.
+            detached = _container_shaping_command(argv, image=shaping_image, watchdog=True)
+            _ota_run(peer, detached, label=f"{peer.name}: profile safety watchdog", dry_run=dry_run, check=False)
+        elif sudo_password is None:
             detached = _passwordless_watchdog_command(argv)
             _ota_run(peer, detached, label=f"{peer.name}: profile safety watchdog", dry_run=dry_run, check=False)
         else:
@@ -3297,6 +3399,8 @@ def _ota_arm_profile(
     *,
     dry_run: bool,
     sudo_passwords: Mapping[str, str] | None = None,
+    sudo_mode: str = OTA_DEFAULT_SUDO_MODE,
+    shaping_image: str | None = None,
 ) -> list[Any]:
     """Arm the static profile per direction on every peer's OTA egress (RFC 0004),
     returning the ``ProfileShaper`` handles to revert in the run's ``finally``."""
@@ -3320,10 +3424,22 @@ def _ota_arm_profile(
         sudo_password = (sudo_passwords or {}).get(peer_name)
         shaper = ProfileShaper(
             ota_iface,
-            _peer_command_runner(peer, dry_run=dry_run, sudo_password=sudo_password),
+            _peer_command_runner(
+                peer,
+                dry_run=dry_run,
+                sudo_password=sudo_password,
+                sudo_mode=sudo_mode,
+                shaping_image=shaping_image,
+            ),
             control_interface=control_iface,
             safety_max_duration_s=_PROFILE_SAFETY_MAX_S,
-            watchdog_launcher=_peer_watchdog_launcher(peer, dry_run=dry_run, sudo_password=sudo_password),
+            watchdog_launcher=_peer_watchdog_launcher(
+                peer,
+                dry_run=dry_run,
+                sudo_password=sudo_password,
+                sudo_mode=sudo_mode,
+                shaping_image=shaping_image,
+            ),
         )
         # Register before arming so a mid-arm failure is still reverted in `finally`.
         shapers.append(shaper)
@@ -4085,7 +4201,20 @@ def _start_noninteractive_ota_smoke(args: argparse.Namespace) -> int:
     errors: list[str] = []
     try:
         if profile is not None:
-            shapers = _ota_arm_profile(plan, profile, directions, dry_run=dry_run)
+            shapers = _ota_arm_profile(
+                plan,
+                profile,
+                directions,
+                dry_run=dry_run,
+                sudo_passwords=_ota_network_sudo_passwords(
+                    plan,
+                    sudo_mode=getattr(args, "sudo_mode", OTA_DEFAULT_SUDO_MODE),
+                    require_network_shaping_sudo=True,
+                    dry_run=dry_run,
+                ),
+                sudo_mode=getattr(args, "sudo_mode", OTA_DEFAULT_SUDO_MODE),
+                shaping_image=getattr(args, "shaping_image", None),
+            )
         _ota_start_peers(
             target,
             plan,
@@ -9039,6 +9168,24 @@ def main(argv: list[str] | None = None) -> int:
         action="store_true",
         help="Keep staged source and project files after cleanup.",
     )
+    ota_smoke_parser.add_argument(
+        "--sudo-mode",
+        choices=OTA_SUDO_MODES,
+        default=OTA_DEFAULT_SUDO_MODE,
+        help=(
+            "How profile shaping obtains tc/ip privileges on the peers "
+            "(passwordless: require sudo -n; askpass: prompt locally per peer and feed sudo -S; "
+            "container: no sudo -- run each tc/ip in a short-lived NET_ADMIN host-netns container, "
+            "for peers with Docker but no passwordless sudo)."
+        ),
+    )
+    ota_smoke_parser.add_argument(
+        "--shaping-image",
+        help=(
+            "Image for --sudo-mode container (must contain tc/ip). Default: resolve on the peer -- "
+            "the image of a running rosotacom_ container, else the newest local ros-communication* image."
+        ),
+    )
     ota_smoke_parser.add_argument("--skip-preflight", action="store_true", help="Skip SSH/Docker readiness checks.")
     ota_smoke_parser.add_argument(
         "--skip-conflict-check",