Install and configure Envoy

[sjmiller609]

Install Envoy in the Kernel browser image.

• Default and template configuration
• Default is direct-mode proxy, static configuration
• Template configuration applied when INST_NAME and METRO_NAME provided
• e2e tests adjusted to use the local proxy, default configuration

---

TL;DR

Installs and configures Envoy in the browser images to act as a local proxy for dynamic traffic routing.

Why we made these changes

To create a flexible networking layer for browser instances. By routing all egress traffic through a local Envoy proxy, we can dynamically configure traffic routing based on the deployment environment (e.g., connecting to different backend services using INST_NAME and METRO_NAME). This avoids hardcoding network paths in the browser image itself.

What changed?

• Envoy Installation & Process Management:
  • Added a shared install-proxy.sh script to install Envoy via APT.
  • Added supervisor-envoy.conf to manage the Envoy process with supervisord.
  • Updated chromium-headful and chromium-headless Dockerfiles to run the installation.
• Dynamic Configuration:
  • A new init-envoy.sh script runs on container startup to configure Envoy.
  • If INST_NAME and METRO_NAME environment variables are present, it uses a dynamic bootstrap.yaml template for xDS.
  • Otherwise, it falls back to a static default.yaml config that sets up a direct-mode forward proxy.
• Browser & Test Integration:
  • Startup scripts (run-docker.sh, wrapper.sh) were updated to initialize Envoy.
  • Chromium is now launched with the --proxy-server=http://127.0.0.1:3128 flag to route all traffic through the local Envoy instance.
  • E2E tests were updated to work with the new default proxy configuration.
• Documentation:
  • The README.md was updated with a "Proxy configuration" section explaining the new setup.

^{Description generated by Mesa. Update settings}

[rgarcia]

some comments in the default and bootstrap configs would be helpful

also in the readme there should be an explanation of the new env vars that control envoy config