Crate sui_dockerfile_node_cache_daemon 

Phase 3b of supa-charge-akeyless-ci: a node-local L0 disk cache daemon.

One instance runs per Kubernetes node (as a DaemonSet, see the sui-dockerfile-node-cache-daemon Helm chart). It listens on a Unix domain socket and answers Get/Put/Warm requests (see protocol) against a node-local disk cache (store), falling through to the existing remote sui_cache::storage::StorageBackend (Postgres L2 / Redis L1, unmodified — see server) on a local miss, persisting the result locally so the next lookup on the same node is a zero-network-hop local hit.

Why a Unix domain socket, not TCP-localhost

A UDS avoids the kernel’s TCP/IP stack entirely (no port allocation, no SO_REUSEADDR races across pod restarts, no risk of binding a port another node-local process expects), and its filesystem-path identity is exactly the shape a DaemonSet’s hostPath mount and a runner pod’s matching mount need to share to discover each other (see the Helm chart’s values.yaml for the mount-path contract). Standard UNIX file permissions on the socket’s parent directory are also a real (if coarse) access boundary that a TCP port lacks. A TCP-localhost fallback was judged unnecessary complexity for a same-host-only protocol — this crate does not implement one.

Reuse, not reinvention

This crate does not invent a new remote cache abstraction — the “remote tier” side of server::NodeCacheDaemon is exactly sui_cache::storage::StorageBackend, the same trait sui-dockerfile-wrapper (Phase 2) and sui cache serve already consume. Only the local L0 tier (store::LocalCacheStore) and the wire protocol (protocol) are new.

Re-exports

pub use protocol::CachedArtifact;

pub use protocol::DaemonRequest;

pub use protocol::DaemonResponse;

pub use protocol::WarmStatus;

pub use server::NodeCacheDaemon;

pub use store::LocalCacheStore;

pub use store::MockLocalCacheStore;

pub use store::RealLocalCacheStore;

Modules

protocol

Typed request/response protocol for the node-local cache daemon.

server

Request-handling core: local-first, remote-on-miss, persist-and-return.

store

The local L0 disk store — the injectable seam this crate’s server logic reads/writes through. Never touched directly by tests; tests use MockLocalCacheStore the same way sui-dockerfile-wrapper’s tests use MockCacheBackend.

Enums

DaemonError

Errors this crate’s server/store/protocol layers can produce. Always typed, never a panic on a fallible path.

Functions

bind_unix_listener

Bind a UnixListener at socket_path, removing any stale socket file left behind by a prior (crashed) instance first — a fresh bind on an existing path otherwise fails with AddrInUse.

default_socket_path

Default socket path — the well-known integration-contract path a DaemonSet pod and a same-node GitHub Actions runner pod must both mount (as a shared hostPath, see the Helm chart) to discover each other. Also the default the sui-dockerfile-wrapper DaemonAwareCacheClient probes when a caller doesn’t override it.

serve

Serve requests on listener until shutdown reports true. Each accepted connection handles exactly one request-response pair then closes — this daemon’s protocol is not multiplexed, mirroring its “quick node-local lookup” workload rather than a long-lived session.