Phase 3b of supa-charge-akeyless-ci: a node-local L0 disk cache
daemon.
One instance runs per Kubernetes node (as a DaemonSet, see the
sui-dockerfile-node-cache-daemon Helm chart). It listens on a
Unix domain socket and answers Get/Put/Warm requests (see
[protocol]) against a node-local disk cache ([store]), falling
through to the existing remote
[sui_cache::storage::StorageBackend] (Postgres L2 / Redis L1,
unmodified — see [server]) on a local miss, persisting the result
locally so the next lookup on the same node is a zero-network-hop
local hit.
Why a Unix domain socket, not TCP-localhost
A UDS avoids the kernel's TCP/IP stack entirely (no port allocation,
no SO_REUSEADDR races across pod restarts, no risk of binding a
port another node-local process expects), and its filesystem-path
identity is exactly the shape a DaemonSet's hostPath mount and a
runner pod's matching mount need to share to discover each other
(see the Helm chart's values.yaml for the mount-path contract).
Standard UNIX file permissions on the socket's parent directory are
also a real (if coarse) access boundary that a TCP port lacks. A
TCP-localhost fallback was judged unnecessary complexity for a
same-host-only protocol — this crate does not implement one.
Reuse, not reinvention
This crate does not invent a new remote cache abstraction — the
"remote tier" side of [server::NodeCacheDaemon] is exactly
[sui_cache::storage::StorageBackend], the same trait
sui-dockerfile-wrapper (Phase 2) and sui cache serve already
consume. Only the local L0 tier ([store::LocalCacheStore]) and the
wire protocol ([protocol]) are new.