Add inference request size

1. 01

   Concepts & system design

   60 min· read · map the mechanismtimer

   R26 — vLLM concurrency & limits

   R03 — OWASP API4 Resource Consumption

   Read the assigned sections; map the mechanism, threat model and trade-offs.

2. 02

   Project implementation

   120 min· build · integrate · debugtimer

   Configure inference request body size limits, worker concurrency caps, bounded request queues, timeouts, and SIGTERM graceful shutdown handlers.

   Build, integrate, debug and improve the increment in the active project.

3. 03

   Security lab

   60 min· attack your own systemtimer

   Simulate concurrent load saturation and abrupt container stop; verify bounded HTTP 429/503 backpressure and clean in-flight request draining without corrupting state.

   Test the abuse case, failure path, authorization bypass or resource limit.

4. 04

   Verification & evidence

   30 min· test · record evidencetimer

   Serving load/backpressure test report and graceful-shutdown verification log.

   Add or run regression tests; record the 9-point evidence record.

5. 05

   Deliberate practice & Socratic review

   30 min· explain aloud · update gapstimer

   Answer the 8 Socratic questions without notes: What? Why? How? What if? Why not? How can I prove it? Where can it break? What have I learned?

   Re-explain the hardest concept aloud, inspect one edge case, update the gap log.

6. total5 h

• R03OWASP API Security Top 10↗ owasp.org

  BOLA (API1), Broken Auth (API2), Unrestricted Resource Consumption (API4), SSRF (API7), Misconfiguration (API8).

• R26vLLM Documentation↗ docs.vllm.ai

  Serving architecture, OpenAI-compatible server, authentication, concurrency flags, and production deployment.

Read only the named sections needed for today's task. Reading sits inside the 60-minute concepts block; it is not extra time.

• docsOWASP API Security Top 10 · ~10 min read
  API4:2023 Unrestricted Resource Consumption

  Names the concrete limits to implement — max upload size, max processes, records per page, operations per request, provider spending caps — plus the DoS and cost-amplification scenarios behind them.

  R03checked 2026-11-11
• videoBugBytes · ~18 min
  SlowAPI and Redis - Rate-Limiting for FastAPI apps!

  Adds a limiter dependency and Redis-backed counters so limits hold across workers, then covers enforcing limits at the proxy layer too — the admission half of the day.

  R03checked 2026-11-11
• articleM. Hassan Ahmed · ~12 min read
  Graceful Shutdown for FastAPI on Kubernetes

  Explains exactly what uvicorn does on SIGTERM, why the PID 1 / shell-form entrypoint breaks it, and how `--timeout-graceful-shutdown` must sit below the grace period.

  R26moved 2026-11-11
• docsUvicorn · Reference
  Settings - Uvicorn

  The flags that implement the day: `--limit-concurrency`, `--backlog`, `--timeout-keep-alive`, and `--timeout-graceful-shutdown` for draining in-flight requests.

  R26moved 2026-11-11
• articleGoogle SRE Book · chapter
  Handling Overload

  Why unbounded queues turn overload into latency collapse, and the load-shedding and adaptive-throttling controls that bound it — the reference defence for queue-flooding tests.

  R03checked 2026-11-11

A lab is complete only when it produces evidence. Installing PyRIT, Garak, Presidio or TransformerLens is not completion. Saved on this device only.