[aaron42net]

Skimming the bucket code, it appears that the rate-limiting information is stored in a map. It doesn't appear to implement an LRU or attempt to clean up stale entries.

If I feed this user-supplied keys such as IP address or cookies, doesn't this mean it will grow without bound?

[yogeshpandey]

Golimit tries to reuse the allocated keys counter entry in case the counter has expired and its not collected by GC. There is a very simple GC logic where GC is invoked periodically, and scans for all buckets one by one and cleans them up. The GC invocation frequency can be configured by setting "gcinterval" property in yaml.

[ttul]

If it is rate limiting IPv4 address space, then you only need a few gigs to store them all... perhaps this is why there is no garbage collection.

[yogeshpandey]

Agree with this. Space used by keys can be reduced by hashing the key. Or for IPs they can be converted to an int value.