diff --git a/Makefile b/Makefile
index 5b7a0bd..35cf67e 100644
--- a/Makefile
+++ b/Makefile
@@ -280,7 +280,8 @@ cmdline.o: mnt.h mnt_newapi.h user.h util.h
 config.o: config.h nsjail.h config.pb.h caps.h cmdline.h logs.h macros.h
 config.o: mnt.h user.h util.h
 contain.o: contain.h nsjail.h config.pb.h caps.h cgroup.h cgroup2.h config.h
-contain.o: cpu.h logs.h macros.h mnt.h net.h pid.h user.h util.h uts.h
+contain.o: cpu.h logs.h macros.h missing_defs.h mnt.h net.h pid.h user.h
+contain.o: util.h uts.h
 cpu.o: cpu.h nsjail.h config.pb.h logs.h util.h
 logs.o: logs.h macros.h util.h nsjail.h config.pb.h
 mnt.o: mnt.h nsjail.h config.pb.h logs.h macros.h mnt_legacy.h mnt_newapi.h
@@ -307,26 +308,27 @@ unotify/syscall.o: unotify/syscall.h unotify/record.h unotify/unotify.pb.h
 unotify/syscall.o: logs.h macros.h unotify/syscall_defs.h util.h nsjail.h
 unotify/syscall.o: config.pb.h
 util.o: util.h nsjail.h config.pb.h logs.h macros.h missing_defs.h
-nstun/nstun.o: nstun/nstun.h nstun/core.h nstun/net_defs.h nstun/icmp.h
-nstun/nstun.o: nstun/iface.h nstun/ip.h logs.h macros.h nstun/policy.h
-nstun/nstun.o: nstun/tcp.h nstun/tun.h nstun/udp.h util.h nsjail.h
-nstun/nstun.o: config.pb.h
-nstun/policy.o: nstun/policy.h nstun/core.h nstun/net_defs.h nstun/nstun.h
-nstun/policy.o: logs.h config.pb.h nsjail.h
+nstun/nstun.o: nstun/nstun.h nstun/core.h nstun/buffer_budget.h
+nstun/nstun.o: nstun/net_defs.h nstun/icmp.h nstun/iface.h nstun/ip.h logs.h
+nstun/nstun.o: macros.h nstun/policy.h nstun/tcp.h nstun/tun.h nstun/udp.h
+nstun/nstun.o: util.h nsjail.h config.pb.h
+nstun/policy.o: nstun/policy.h nstun/core.h nstun/buffer_budget.h
+nstun/policy.o: nstun/net_defs.h nstun/nstun.h logs.h config.pb.h nsjail.h
 nstun/encap.o: nstun/encap.h nstun/net_defs.h logs.h
 nstun/iface.o: nstun/iface.h logs.h macros.h nstun/net_defs.h nsjail.h
 nstun/iface.o: config.pb.h nstun/nstun.h
-nstun/tun.o: nstun/tun.h nstun/core.h nstun/net_defs.h nstun/nstun.h
-nstun/tun.o: nstun/icmp.h nstun/ip.h logs.h
-nstun/ip.o: nstun/ip.h nstun/core.h nstun/net_defs.h nstun/nstun.h
-nstun/ip.o: nstun/icmp.h logs.h nstun/tcp.h nstun/udp.h
-nstun/icmp.o: nstun/icmp.h nstun/core.h nstun/net_defs.h nstun/nstun.h logs.h
-nstun/icmp.o: macros.h nstun/policy.h nstun/tun.h
-nstun/udp.o: nstun/udp.h nstun/core.h nstun/net_defs.h nstun/nstun.h
-nstun/udp.o: nstun/encap.h nstun/icmp.h logs.h macros.h nstun/policy.h
-nstun/udp.o: nstun/tun.h
-nstun/tcp.o: nstun/tcp.h nstun/core.h nstun/net_defs.h nstun/nstun.h
-nstun/tcp.o: nstun/encap.h logs.h macros.h nstun/policy.h nstun/tun.h util.h
-nstun/tcp.o: nsjail.h config.pb.h
+nstun/tun.o: nstun/tun.h nstun/core.h nstun/buffer_budget.h nstun/net_defs.h
+nstun/tun.o: nstun/nstun.h nstun/icmp.h nstun/ip.h logs.h
+nstun/ip.o: nstun/ip.h nstun/core.h nstun/buffer_budget.h nstun/net_defs.h
+nstun/ip.o: nstun/nstun.h nstun/icmp.h logs.h nstun/tcp.h nstun/udp.h
+nstun/icmp.o: nstun/icmp.h nstun/core.h nstun/buffer_budget.h
+nstun/icmp.o: nstun/net_defs.h nstun/nstun.h logs.h macros.h nstun/policy.h
+nstun/icmp.o: nstun/tun.h
+nstun/udp.o: nstun/udp.h nstun/core.h nstun/buffer_budget.h nstun/net_defs.h
+nstun/udp.o: nstun/nstun.h nstun/encap.h nstun/icmp.h logs.h macros.h
+nstun/udp.o: nstun/policy.h nstun/tun.h
+nstun/tcp.o: nstun/tcp.h nstun/core.h nstun/buffer_budget.h nstun/net_defs.h
+nstun/tcp.o: nstun/nstun.h nstun/encap.h logs.h macros.h nstun/policy.h
+nstun/tcp.o: nstun/tun.h util.h nsjail.h config.pb.h
 config.pb.o: config.pb.h
 unotify/unotify.pb.o: unotify/unotify.pb.h
diff --git a/mnt_legacy.cc b/mnt_legacy.cc
index 3a64dfb..a0f8576 100644
--- a/mnt_legacy.cc
+++ b/mnt_legacy.cc
@@ -340,7 +340,8 @@ bool remountPt(mnt::mount_t& mpt) {
 				}
 				std::string mp(p, endp - p);
 				if (mp != mpt.dst && mp.compare(0, prefix.size(), prefix) == 0) {
-					/* best-effort; remountOne logs any submount it can't re-flag */
+					/* best-effort; remountOne logs any submount it can't
+					 * re-flag */
 					remountOne(mp, mpt);
 				}
 			}
diff --git a/mnt_newapi.cc b/mnt_newapi.cc
index 686b35b..1b85f2d 100644
--- a/mnt_newapi.cc
+++ b/mnt_newapi.cc
@@ -84,7 +84,8 @@ std::unique_ptr<std::string> buildMountTree(nsj_t*, std::vector<mnt::mount_t>*)
 namespace mnt {
 namespace newapi {
 
-static bool applyMountFlags(int fd, uintptr_t flags, bool log_error = true, bool recursive = false) {
+static bool applyMountFlags(
+    int fd, uintptr_t flags, bool log_error = true, bool recursive = false) {
 	struct mount_attr attr = {};
 
 	if (flags & MS_RDONLY) {
@@ -185,8 +186,8 @@ static bool remountWithLegacyMount(const mount_t& mpt) {
 }
 
 static bool openMountForRemount(mount_t* mpt, int parent_fd, const char* basename) {
-	mpt->fd = util::syscall(
-	    __NR_open_tree, (uintptr_t)parent_fd, (uintptr_t)basename, (uintptr_t)OPEN_TREE_CLOEXEC);
+	mpt->fd = util::syscall(__NR_open_tree, (uintptr_t)parent_fd, (uintptr_t)basename,
+	    (uintptr_t)OPEN_TREE_CLOEXEC);
 	if (mpt->fd < 0) {
 		PLOG_W("open_tree(parent_fd, '%s')", basename);
 		return false;
@@ -417,7 +418,8 @@ static bool mountSymlinkAt(mount_t* mpt, int parent_fd, const char* basename) {
 			PLOG_E("symlinkat('%s' -> '%s')", mpt->src.c_str(), basename);
 			return false;
 		}
-		PLOG_W("symlinkat('%s' -> '%s') failed (non-mandatory)", mpt->src.c_str(), basename);
+		PLOG_W(
+		    "symlinkat('%s' -> '%s') failed (non-mandatory)", mpt->src.c_str(), basename);
 	}
 	return true;
 }
@@ -492,8 +494,7 @@ static bool doBindMountAt(mount_t* mpt, int parent_fd, const char* basename) {
 	 * keep their original suid/dev/exec-permitting attributes inside the jail.
 	 * This mirrors the recursive read-only pass done later on the root.
 	 */
-	if (!applyMountFlags(
-		mnt_fd, mpt->flags & ~MS_RDONLY, true, (mpt->flags & MS_REC) != 0)) {
+	if (!applyMountFlags(mnt_fd, mpt->flags & ~MS_RDONLY, true, (mpt->flags & MS_REC) != 0)) {
 		LOG_W("Failed to apply mount flags to '%s'", basename);
 	}
 
@@ -542,8 +543,8 @@ static bool mountSinglePointAt(mount_t* mpt, int root_fd) {
 			}
 		}
 	} else {
-		int fd = openat(parent_fd, basename.c_str(),
-		    O_CREAT | O_RDONLY | O_CLOEXEC | O_NOFOLLOW, 0644);
+		int fd = openat(
+		    parent_fd, basename.c_str(), O_CREAT | O_RDONLY | O_CLOEXEC | O_NOFOLLOW, 0644);
 		if (fd >= 0) {
 			close(fd);
 		} else if (errno != EROFS || !util::existsAsRegAt(parent_fd, basename.c_str())) {
diff --git a/nstun/icmp.cc b/nstun/icmp.cc
index 9000ace..6f1693b 100644
--- a/nstun/icmp.cc
+++ b/nstun/icmp.cc
@@ -179,7 +179,7 @@ void handle_icmp6(Context* ctx, const ip6_hdr* ip, std::span<const uint8_t> payl
 			LOG_D("ICMPv6 dropped by policy");
 			return;
 		} else if (rule.action == NSTUN_ACTION_ENCAP_SOCKS5 ||
-		           rule.action == NSTUN_ACTION_ENCAP_CONNECT) {
+			   rule.action == NSTUN_ACTION_ENCAP_CONNECT) {
 			LOG_D("Proxy encapsulation is not supported for ICMPv6, dropping");
 			return;
 		} else if (rule.action == NSTUN_ACTION_REJECT) {
@@ -303,7 +303,7 @@ void handle_icmp4(Context* ctx, const ip4_hdr* ip, std::span<const uint8_t> payl
 			LOG_D("ICMP dropped by policy");
 			return;
 		} else if (rule.action == NSTUN_ACTION_ENCAP_SOCKS5 ||
-		           rule.action == NSTUN_ACTION_ENCAP_CONNECT) {
+			   rule.action == NSTUN_ACTION_ENCAP_CONNECT) {
 			LOG_D("Proxy encapsulation is not supported for ICMP, dropping");
 			return;
 		} else if (rule.action == NSTUN_ACTION_REJECT) {
diff --git a/nstun/nstun.cc b/nstun/nstun.cc
index f901283..d17c213 100644
--- a/nstun/nstun.cc
+++ b/nstun/nstun.cc
@@ -547,8 +547,8 @@ void nstun_destroy_parent(struct nstun_context_handle* handle) {
 
 	if (handle->context != nullptr && handle->context->stop_fd != -1) {
 		const uint64_t one = 1;
-		if (TEMP_FAILURE_RETRY(
-			write(handle->context->stop_fd, &one, sizeof(one))) == -1 && errno != EPIPE) {
+		if (TEMP_FAILURE_RETRY(write(handle->context->stop_fd, &one, sizeof(one))) == -1 &&
+		    errno != EPIPE) {
 			PLOG_W("write(stop_fd)");
 		}
 	}
diff --git a/nstun/nstun.h b/nstun/nstun.h
index 0dfd4e9..7d0208e 100644
--- a/nstun/nstun.h
+++ b/nstun/nstun.h
@@ -52,8 +52,7 @@ struct nsj_t;
 struct nstun_context_handle;
 
 bool nstun_init_child(int sock, struct nsj_t* nsj);
-bool nstun_init_parent(
-	int sock, struct nsj_t* nsj, struct nstun_context_handle** out_handle);
+bool nstun_init_parent(int sock, struct nsj_t* nsj, struct nstun_context_handle** out_handle);
 void nstun_destroy_parent(struct nstun_context_handle* handle);
 
 #ifdef __cplusplus
diff --git a/sandbox.cc b/sandbox.cc
index 7557f22..4d7780d 100644
--- a/sandbox.cc
+++ b/sandbox.cc
@@ -139,10 +139,9 @@ bool applyPolicy(nsj_t* nsj, int pipefd) {
 			 * running with NO seccomp policy at all despite one being requested.
 			 * Fail loudly instead of silently dropping the requested policy.
 			 */
-			LOG_E(
-			    "seccomp_unotify was requested but this execution mode has no "
-			    "supervisor to receive the notification fd; refusing to run the "
-			    "sandboxee without the requested seccomp policy");
+			LOG_E("seccomp_unotify was requested but this execution mode has no "
+			      "supervisor to receive the notification fd; refusing to run the "
+			      "sandboxee without the requested seccomp policy");
 			return false;
 		}
 		if (!installUnotifyFilter(nsj, pipefd)) {
diff --git a/util.cc b/util.cc
index 6dc635a..6e9e190 100644
--- a/util.cc
+++ b/util.cc
@@ -300,8 +300,8 @@ bool createDirRecursively(const char* dir) {
 		int dir_fd = TEMP_FAILURE_RETRY(
 		    openat(prev_dir_fd, curr, O_DIRECTORY | O_CLOEXEC | O_NOFOLLOW));
 		if (dir_fd == -1) {
-			PLOG_W("openat('%d', %s, O_DIRECTORY | O_CLOEXEC | O_NOFOLLOW)", prev_dir_fd,
-			    QC(curr));
+			PLOG_W("openat('%d', %s, O_DIRECTORY | O_CLOEXEC | O_NOFOLLOW)",
+			    prev_dir_fd, QC(curr));
 			close(prev_dir_fd);
 			return false;
 		}