feat(docker): packet filters on kernel-datapath links via tc netem

Impairment filters with a netem equivalent (delay, packet_loss, corrupt)
now run on the kernel datapath as one tc netem qdisc per veth host end,
pushed through uBridge's netlink tc module (tc netem set / tc reset).
This removes the relay delay filter's nanosleep bottleneck (upstream

Both link endpoints carry the filters: each end's qdisc egress covers
the traffic entering that container, so every direction is impaired
exactly once -- the same net effect as the relay, where both directions
cross the single filtered bridge.

- controller: eligibility keys on relay-only types (frequency_drop, bpf)
  instead of any filter; kernel links push the real filters (the
  synthetic suspend frequency_drop no longer flips a suspended link to
  relay on reopen/reset); update_filters 409s only relay-only types;
  available_filters hides them on kernel links
- compute: create_nio whitelists netem-capable filter types; the NIO
  update path keeps its own guard (PUT mutates the NIO in place);
  _ubridge_apply_netem translates the filter dict into one atomic
  netem-set (full re-apply IS the reconcile); node restart restores the
  qdisc, link deletion detaches it (the veth survives the link)
- e2e (27/27): delay 100 -> 200.2 ms RTT, atomic replace 50 -> 100.2 ms,
  clear -> baseline, packet_loss 30 -> 48 % round-trip (expected 51 %),
  suspend/resume and node restart keep the qdisc, link delete leaves no
  residual impairment

gns3server/controller/link.py

@@ -116,8 +116,9 @@ class Link:
         """
         Whether this link is wired on the kernel datapath (veth pairs
         enslaved into a per-link Linux bridge — no uBridge relay in the
-        forwarding path, so filters and markers are unavailable; capture is
-        served by uBridge's AF_PACKET module).
+        forwarding path). Impairment filters run as tc netem on the veth
+        host end; markers and capture are served by uBridge's AF_PACKET
+        module.
         """
         return any(d.get("type") == "nio_bridge" for d in (getattr(self, "_link_data", None) or []))
 
@@ -234,11 +235,18 @@ class Link:
         except FilterValidationError as e:
             raise ControllerError(f"Invalid packet filter parameters: {e!s}")
 
-        if new_filters and self.kernel_datapath:
-            raise ControllerError(
-                "Packet filters are not supported on kernel-datapath links (no uBridge relay "
-                "in the forwarding path); delete and recreate the link to use filters"
-            )
+        if self.kernel_datapath:
+            from gns3server.utils.packet_filter_validation import KERNEL_UNSUPPORTED_FILTERS
+
+            unsupported = KERNEL_UNSUPPORTED_FILTERS.intersection(new_filters or {})
+            if unsupported:
+                raise ControllerError(
+                    "Packet filter(s) {} cannot run on a kernel-datapath link (no uBridge relay "
+                    "in the forwarding path; delay, packet loss and corrupt are served by tc "
+                    "netem on the veth); delete and recreate the link to use them".format(
+                        ", ".join(sorted(unsupported))
+                    )
+                )
 
         if new_filters != self.filters:
             self._filters = new_filters
@@ -637,6 +645,13 @@ class Link:
         """
         filter_node = self._get_filter_node()
         if filter_node:
+            if self.kernel_datapath:
+                # Kernel-datapath links serve filters via tc netem on the
+                # veth host end; types without a netem equivalent (which
+                # only run in the uBridge relay) are hidden from the picker.
+                from gns3server.utils.packet_filter_validation import KERNEL_UNSUPPORTED_FILTERS
+
+                return [f for f in FILTERS if f["type"] not in KERNEL_UNSUPPORTED_FILTERS]
             return FILTERS
         return []