Add Envoy network-proxy backend behind TOOLHIVE_NETWORK_PROXY=envoy

[ChrisJBurns]

Summary

Adds an Envoy-based network-proxy backend that consolidates the egress (forward proxy) and ingress (reverse proxy) into a single container, cutting the per-workload auxiliary count from 3 → 2. Opt-in via TOOLHIVE_NETWORK_PROXY=envoy; Squid stays the default and is untouched.

Closes #5902. Part of #5900.

Stacked on #5906 (the networkProxy seam). This PR targets cburns/envoy-proxy-seam, so its diff shows only the Envoy work. Review/merge #5906 first; GitHub will retarget this PR to main when the base branch merges. (See stacked PRs.)

Medium level

• New envoyProxy backend implementing the networkProxy.SetupProxies seam. Selected when TOOLHIVE_NETWORK_PROXY=envoy; newNetworkProxy gains the envoy case and a compile-time assertion.
• Typed, protobuf-JSON Envoy bootstrap generator (structs + pure builder functions), written to a 0600 temp file and bind-mounted read-only. Every typed_config carries the required @type URL.
• Egress (:3128): HTTP connection manager with CONNECT upgrade + a CONNECT route matcher (HTTPS tunnelling), a dynamic_forward_proxy cluster, and two RBAC filters — a gateway DENY (L3 destination_ip CIDR + L7 :authority) evaluated before an allowlist ALLOW.
• Ingress: reverse-proxy listener bound 0.0.0.0:<port> inside the container (Docker port-forwarding targets the bridge IP, not loopback), routing to a STRICT_DNS upstream cluster targeting the MCP container; Inbound.AllowHost restricts the virtual-host domains.
• AllowHost parity with Squid dstdomain: a leading dot (or *.) matches apex + subdomains, a bare host matches exactly; the generated regex is anchored, case-insensitive, and tolerates the :port that HTTPS CONNECT authorities carry.
• Admin API bound to 127.0.0.1; stdout access logging on both listeners.
• Architecture doc: docs/arch/14-envoy-network-proxy.md (design, Squid-vs-Envoy comparison, known limitations).

Low level

File	Change
pkg/container/docker/envoy.go	New — config model, buildEgressListener/buildIngressListener, cluster builders, writeEnvoyBootstrap, getEnvoyImage, hostMatchRegex, envoyProxy.SetupProxies
pkg/container/docker/networkproxy.go	Add envoy case to newNetworkProxy + compile-time assertion
pkg/container/docker/envoy_test.go	New — table tests for RBAC allowlist/default-deny, host-match semantics, ingress gating, clusters, file mode, admin loopback, @type URLs
pkg/container/docker/networkproxy_test.go	Add envoy factory case
pkg/container/docker/client_stop_test.go	Add cleanup-topology test (2-container Envoy vs 3-container Squid)
docs/arch/14-envoy-network-proxy.md	New — architecture doc

Type of change

• New feature

Test plan

• task build passes
• task test passes for pkg/container/docker/... with -race
• golangci-lint clean on the changed package
• Generated config validated against real Envoy v1.32.3 (--mode validate) with allowlist + gateway deny + ingress
• TestBuildEgressListener_AllowlistAndDefaultDeny, TestBuildEgressListener_EmptyAllowHostDenyAll, TestHostMatchRegex — allowlist, default-deny, InsecureAllowAll, Squid dstdomain parity
• TestBuildIngressListener_PortAndHostGating, TestBuildIngressCluster_UpstreamAddress — ingress reverse proxy + Inbound.AllowHost
• TestStopProxyContainer_HandlesEnvoyAndSquidTopologies — cleanup handles both 2- and 3-container workloads
• TestNewNetworkProxy — Squid default, envoy selectable, unknown value errors
• Manually tested TOOLHIVE_NETWORK_PROXY=envoy thv run io.github.stacklok/fetch: docker ps shows -egress (Envoy) + -dns only (no -ingress); allowed hosts reachable over HTTP+HTTPS; docker gateway (IP + host.docker.internal + gateway.docker.internal) blocked

Special notes for reviewers

Size: envoy.go is ~600 production lines, over the soft 400-line limit, but it is one cohesive addition — roughly half is JSON-tagged struct definitions for the Envoy bootstrap, and the config generator is exhaustively table-tested. Splitting the config model from the ~150-line SetupProxies wiring is possible but leaves the first half as inert dead code. Flagging for a conscious call.

Config generation: hand-rolled typed structs → protobuf-JSON. Unit tests assert the Go-level shape and @type URLs; the --mode validate run confirms real Envoy accepts the full config. Known limitations (tag-pinned image, always-on admin, health-check log noise) are tracked as hardening follow-ups in #5903.

Generated with Claude Code

[JAORMX]

Panel review — Envoy network-proxy backend

Reviewed across four lenses (security, Go correctness, architecture/parity, MCP transport). This is high-quality work — clean typed-struct → protobuf-JSON generation, exhaustive table tests, a real-Envoy --mode validate test, honest self-documented limitations, and container hardening that's actually better than Squid (CapDrop:[ALL], 0600 bootstrap). The seam wiring, network attachment, teardown, and hostPort flow are all at parity with Squid, and the STRICT_DNS-before-MCP design is correctly immune to the negative-DNS-cache problem that forces Squid to defer ingress.

I'm leaving this as a comment rather than a formal block, but there are three issues I'd resolve before this ships, plus a coverage gap that explains why green CI didn't catch them. Inline comments have detail + suggested fixes.

🔴 Would-block:

1. SSE / streamable-http streams die at 15s — the ingress route sets no timeout, so it inherits Envoy's 15s default RouteAction.timeout (a hard total-response cap, not idle-based). Breaks the two primary networked MCP transports. Regression vs Squid. → set route timeout: "0s" + HCM stream_idle_timeout: 0.
2. Gateway deny enforced only on the :authority string, not the resolved IP — any hostname resolving to 172.17.0.1 (DNS rebinding / attacker record / repointed allowlist host) bypasses it; Squid's dst ACL denies on resolved IP. Silently weakens the core --isolate-network guarantee.
3. Trailing-dot bypass — host.docker.internal. / 172.17.0.1. don't match the anchored deny regex but resolve identically (reproduced). One-line regex fix.

🟡 Medium:
4. AllowPort silently dropped (allowlisted host reachable on any port) — already documented + tracked in #5915.
5. No E2E lane sets TOOLHIVE_NETWORK_PROXY=envoy, so the whole backend is runtime-untested in CI — this is why #1 slipped through green checks.

🟢 Minor / confirmed-sound: deny-all-on-empty-profile is an intentional, fail-closed divergence (safe, but a migration gotcha worth calling out); bootstrap temp-file leak + reboot bind-mount exposure are parity with Squid and fail-closed; listeners binding 0.0.0.0 on the bridge is parity. The empty-Policies=deny-all invariant (no omitempty), RBAC filter ordering, allowlist regex anchoring, and the PullImage→ImageExists fallback (an improvement over Squid's bug) are all correct.

Nice work overall — the design is sound and the divergences are mostly conscious. Fixing #1–#3 gets it there.

_{Generated with Claude Code}

[JAORMX]

Approving — review feedback addressed and verified

Re-reviewed at 1fa4fbb5. All three blockers from the panel review are resolved and verified:

• SSE / streamable-http 15s cap — envoyRouteAction.Timeout and envoyHCM.StreamIdleTimeout fields added and set to "0s" on both the ingress route/HCM and the egress route/HCM (nice — the egress plain-HTTP path was covered too). Long-lived MCP streams will no longer be truncated.
• Trailing-dot gateway bypass — hostMatchRegex now appends \.? before the optional port group. Verified: host.docker.internal., 172.17.0.1., and HOST.DOCKER.INTERNAL. are now denied, while example.com.attacker.com and example.com.. remain correctly rejected (no over-broadening).
• Bootstrap temp-file leak — SetupEgress now uses a success flag with a deferred os.Remove, so the file is cleaned up on every post-write failure path and only persists on success for the bind mount.
• Doc accuracy — the comparison-table row is softened to ~ (IP literal in :authority only; resolved IP not enforced) and the resolved-IP limitation is documented.

The two consciously-deferred gaps are acceptable for an experimental, opt-in backend (Squid remains the untouched default, and the Internal:true network is the real fail-closed backstop):

• Resolved-IP gateway deny — genuinely not fixable at L7 for a forward proxy (RBAC can't see the DFP-resolved address); documented as a known limitation.
• AllowPort parity — tracked in #5915.
• E2E coverage — the {squid, envoy} parametrization is in flight in #5918. Worth landing that reasonably soon so the backend isn't runtime-untested going forward.

CI is green across all 104 checks on this head. Thanks for the fast, thorough turnaround.

_{Generated with Claude Code}