Verify end-to-end on kind: fix Squid FD-table OOM, make the quickstart in-cluster

Co-Authored-By: Claude <noreply@anthropic.com>

internal/provider/kubernetes/pod.go

@@ -58,10 +58,18 @@ func buildPod(image string, req provider.CreateRequest) *corev1.Pod {
 // there, never interpreted. via/forwarded_for are turned off so the proxy
 // doesn't leak the Pod's identity to the origin.
 func squidConf(port int32) string {
+	// max_filedescriptors is load-bearing in containers: squid sizes its FD
+	// tables from RLIMIT_NOFILE at startup, and containerd commonly sets
+	// that to effectively unlimited (kind: ~10^9) — squid then allocates
+	// gigabytes and is OOM-killed before it ever listens. cache_mem is
+	// trimmed because a forwarding proxy for crawling gains nothing from
+	// squid's 256 MB default cache.
 	return fmt.Sprintf(`http_port %d
 acl all src 0.0.0.0/0
 http_access allow all
 via off
 forwarded_for off
+max_filedescriptors 1024
+cache_mem 16 MB
 `, port)
 }

internal/provider/kubernetes/pod_test.go

@@ -72,7 +72,10 @@ func TestBuildPod_usesRequestPort(t *testing.T) {
 func TestSquidConf_permissive(t *testing.T) {
 	t.Parallel()
 	conf := squidConf(3128)
-	for _, want := range []string{"http_port 3128", "http_access allow all", "via off", "forwarded_for off"} {
+	// max_filedescriptors guards against squid sizing its FD tables from a
+	// container's effectively-unlimited RLIMIT_NOFILE and getting OOM-killed
+	// at startup — found by the kind verification run, must not regress.
+	for _, want := range []string{"http_port 3128", "http_access allow all", "via off", "forwarded_for off", "max_filedescriptors 1024"} {
 		if !strings.Contains(conf, want) {
 			t.Errorf("squidConf() = %q, want it to contain %q", conf, want)
 		}