v0.1.4 (#38) — pipeline test 2

internal/envdclient/dialer.go

@@ -2,7 +2,9 @@ package envdclient
 
 import (
 	"fmt"
+	"net"
 	"net/http"
+	"time"
 )
 
 // envdPort is the default port envd listens on inside the guest.
@@ -13,9 +15,19 @@ func baseURL(hostIP string) string {
 	return fmt.Sprintf("http://%s:%d", hostIP, envdPort)
 }
 
-// newHTTPClient returns an http.Client suitable for talking to envd.
-// No special transport is needed — envd is reachable via the host IP
-// through the veth/TAP network path.
+// newHTTPClient returns an http.Client with a dedicated transport for talking
+// to envd. The transport is intentionally separate from http.DefaultTransport
+// so that proxy traffic to user services inside the sandbox cannot interfere
+// with envd RPC connections (PTY streams, exec, file ops).
 func newHTTPClient() *http.Client {
-	return &http.Client{}
+	return &http.Client{
+		Transport: &http.Transport{
+			MaxIdleConnsPerHost: 10,
+			IdleConnTimeout:     90 * time.Second,
+			DialContext: (&net.Dialer{
+				Timeout:   10 * time.Second,
+				KeepAlive: 30 * time.Second,
+			}).DialContext,
+		},
+	}
 }