Add per-job data transfer quota (AWS)

[peterschmidt85]

Summary

• Adds DSTACK_SERVER_DATA_TRANSFER_QUOTA_PER_JOB_AWS server setting (bytes, 0=unlimited) to terminate jobs exceeding outbound data transfer limits
• Metering uses iptables byte counters on the shim (host-level), hooked into both OUTPUT and FORWARD chains to cover host and bridge Docker network modes
• Private/VPC traffic (10.0.0.0/8, 172.16.0.0/12, etc.) is excluded — only external/billable traffic counts
• Shim notifies the runner via a new POST /api/terminate endpoint, so the server reads the termination reason through the existing /api/pull flow (same pattern as log quota)
• Job fails with data_transfer_quota_exceeded termination reason, visible in CLI and UI
• AWS-only for now; other backends can be added via DSTACK_SERVER_DATA_TRANSFER_QUOTA_PER_JOB_GCP, etc.

Files changed

Go (shim/runner):

• runner/internal/shim/netmeter/ — new package: iptables chain setup, byte counter polling, quota check
• runner/internal/shim/docker.go — waitContainerWithQuota() method wired into Run()
• runner/internal/runner/api/ — new POST /api/terminate endpoint
• runner/internal/common/types/types.go — TerminationReasonDataTransferQuotaExceeded

Python (server):

• settings.py — SERVER_DATA_TRANSFER_QUOTA_PER_JOB_AWS env var
• runs.py — DATA_TRANSFER_QUOTA_EXCEEDED termination reason
• jobs_running.py / running_jobs.py — pass quota to shim for AWS backend

Test plan

• Unit tests for iptables output parsing (netmeter_test.go)
• Integration test on AWS: verified iptables metering works in both Docker host and bridge modes
• E2E test on AWS: task terminated at ~10MB with Error (Data transfer quota exceeded) in dstack ps
• E2E test on Crusoe (non-AWS): task ran past 10MB without metering — quota correctly not enforced

🤖 Generated with Claude Code