update

Author: lyang2821

crates/kube-manager/src/manager.rs

@@ -139,11 +139,11 @@ impl KubeManager {
         tokio::select! {
             result = tunnel_task => {
                 tracing::error!("Tunnel task completed unexpectedly: {:?}", result);
-                return Err(anyhow!("Tunnel task completed unexpectedly"));
+                Err(anyhow!("Tunnel task completed unexpectedly"))
             }
             result = main_task => {
                 tracing::error!("Main task completed unexpectedly: {:?}", result);
-                return Err(anyhow!("Main task completed unexpectedly"));
+                Err(anyhow!("Main task completed unexpectedly"))
             }
         }
     }

crates/kube-sidecar-proxy/Cargo.toml

@@ -64,7 +64,7 @@ url = "2.5"
 httparse = "1.8"
 http = "1.0"
 
-# System level networking for iptables redirection
+# Low-level networking support
 libc = "0.2"
 nix = { version = "0.29", features = ["socket", "net"] }
 

crates/kube-sidecar-proxy/src/config.rs

@@ -19,7 +19,7 @@ use uuid::Uuid;
 /// Immutable settings for the sidecar proxy determined at boot time.
 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct SidecarSettings {
-    /// Address the sidecar listens on for iptables redirected traffic.
+    /// Address the sidecar listens on for redirected service traffic.
     pub listen_addr: SocketAddr,
     /// Namespace the sidecar is running in.
     pub namespace: Option<String>,

crates/kube/src/server.rs

@@ -1488,7 +1488,7 @@ impl KubeClusterServer {
         for (catalog_id, workload_ids) in workloads_by_catalog {
             let new_version = self
                 .db
-                .bump_app_catalog_sync_version(catalog_id, synced_at.clone())
+                .bump_app_catalog_sync_version(catalog_id, synced_at)
                 .await
                 .with_context(|| {
                     format!(

crates/tunnel/src/error.rs

@@ -17,9 +17,7 @@ impl From<TunnelError> for io::Error {
             TunnelError::ConnectionClosed => {
                 io::Error::new(io::ErrorKind::BrokenPipe, TunnelError::ConnectionClosed)
             }
-            TunnelError::Remote(reason) => {
-                io::Error::new(io::ErrorKind::Other, TunnelError::Remote(reason))
-            }
+            TunnelError::Remote(reason) => io::Error::other(TunnelError::Remote(reason)),
         }
     }
 }

crates/tunnel/src/relay.rs

@@ -368,7 +368,7 @@ where
 {
     let (sink, stream) = websocket.split();
 
-    let sink = sink.sink_map_err(|err| io::Error::other(err));
+    let sink = sink.sink_map_err(io::Error::other);
 
     let stream = stream.filter_map(|msg| {
         future::ready(match msg {

crates/tunnel/src/server.rs

@@ -64,7 +64,7 @@ impl TunnelConnector for TcpConnector {
 }
 
 pub async fn run_tunnel_server(connection: Connection) -> Result<(), TunnelError> {
-    run_tunnel_server_with_connector(connection, TcpConnector::default()).await
+    run_tunnel_server_with_connector(connection, TcpConnector).await
 }
 
 pub async fn run_tunnel_server_with_connector<C>(
@@ -145,7 +145,7 @@ async fn pipe_streams(
 
     tokio_io::copy_bidirectional(&mut quic_stream, &mut target)
         .await
-        .map_err(|err| TunnelError::Transport(err))?;
+        .map_err(TunnelError::Transport)?;
     Ok(())
 }
 

crates/tunnel/src/websocket.rs

@@ -79,7 +79,7 @@ where
                 let buf = BytesMut::from(bytes.as_ref());
                 match this.codec.as_mut().deserialize(&buf) {
                     Ok(item) => Poll::Ready(Some(Ok(item))),
-                    Err(err) => Poll::Ready(Some(Err(io::Error::new(io::ErrorKind::Other, err)))),
+                    Err(err) => Poll::Ready(Some(Err(io::Error::other(err)))),
                 }
             }
             Some(Err(err)) => Poll::Ready(Some(Err(err))),
@@ -110,7 +110,7 @@ where
             .codec
             .as_mut()
             .serialize(&item)
-            .map_err(|err| io::Error::new(io::ErrorKind::Other, err))?;
+            .map_err(|err| io::Error::other(err))?;
         this.inner.start_send(bytes)
     }
 
@@ -137,7 +137,7 @@ where
         loop {
             match futures::ready!(inner.0.poll_next_unpin(cx)) {
                 Some(Ok(Message::Binary(data))) => {
-                    return Poll::Ready(Some(Ok(Bytes::from(data))));
+                    return Poll::Ready(Some(Ok(data)));
                 }
                 Some(Ok(Message::Close(_))) => return Poll::Ready(None),
                 Some(Ok(_)) => continue,
@@ -157,30 +157,21 @@ where
     type Error = io::Error;
 
     fn poll_ready(self: Pin<&mut Self>, cx: &mut Context<'_>) -> Poll<io::Result<()>> {
-        self.project()
-            .0
-            .poll_ready(cx)
-            .map_err(|err| io::Error::other(err))
+        self.project().0.poll_ready(cx).map_err(io::Error::other)
     }
 
     fn start_send(self: Pin<&mut Self>, item: Bytes) -> io::Result<()> {
         self.project()
             .0
             .start_send(Message::Binary(item))
-            .map_err(|err| io::Error::other(err))
+            .map_err(io::Error::other)
     }
 
     fn poll_flush(self: Pin<&mut Self>, cx: &mut Context<'_>) -> Poll<io::Result<()>> {
-        self.project()
-            .0
-            .poll_flush(cx)
-            .map_err(|err| io::Error::other(err))
+        self.project().0.poll_flush(cx).map_err(io::Error::other)
     }
 
     fn poll_close(self: Pin<&mut Self>, cx: &mut Context<'_>) -> Poll<io::Result<()>> {
-        self.project()
-            .0
-            .poll_close(cx)
-            .map_err(|err| io::Error::other(err))
+        self.project().0.poll_close(cx).map_err(io::Error::other)
     }
 }

docs/core-concepts/architecture/branch-environment-architecture.md

@@ -96,14 +96,14 @@ const response = await axios.get('http://other-service:8080/api', {
 
 **3. Routing Decision**
 
-The Lapdev Sidecar Proxy (automatically injected by Lapdev into each pod in managed environments):
+The Lapdev Sidecar Proxy (automatically injected by Lapdev into each pod in managed environments) sits in front of your workload traffic:
 
-1. Intercepts outgoing HTTP requests from your service
+1. Intercepts incoming requests headed to your service
 2. Reads the `tracestate` header to identify the branch
 3. Checks if the target service has a branch override for this branch
-4. Routes to the branched version if it exists
-5. Routes to the shared environment if no override exists
-6. The header continues to propagate to the next service
+4. If a Devbox intercept is active for this branch/service, routes to the developer’s local process; otherwise routes to the branched service if present
+5. Falls back to the shared environment if no branch-specific target exists
+6. The header continues downstream, so the next hop can repeat the decision
 
 > **Note:** The sidecar proxy is automatically added when Lapdev creates your environment. No manual configuration needed. For more details, see [Traffic Routing Architecture](traffic-routing-architecture.md).
 

pkg/image/vnc/Dockerfile

@@ -1,6 +1,6 @@
 FROM debian:12
 
-RUN apt-get update && apt-mark hold iptables && \
+RUN apt-get update && \
     env DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
       dbus-x11 \
       psmisc \