Extract shared RELAY_CHUNK_SIZE constant

Four TCP/Unix byte-relay loops (rpc_bridge, host_socket_forward, two
in cli tcp relay) all hard-coded the same 8 KB read buffer. Move it
to airlock_common::RELAY_CHUNK_SIZE so the chunk size stays symmetric
on both ends of the RPC if we tune it. Measurement showed no
throughput benefit from bumping to 64 KB — kernel-side TCP batching
already coalesces bytes upstream of our relay.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Author: milankinen

app/airlock-cli/src/network/tcp.rs

@@ -46,7 +46,7 @@ pub async fn connect_server(addr: &str) -> anyhow::Result<io::Transport> {
 /// When either direction closes, both sides are fully shut down.
 pub async fn relay(mut container: io::Transport, mut server: io::Transport) {
     let c2s = async {
-        let mut buf = [0u8; 8192];
+        let mut buf = vec![0u8; airlock_common::RELAY_CHUNK_SIZE];
         loop {
             match container.read.read(&mut buf).await {
                 Ok(0) | Err(_) => break,
@@ -60,7 +60,7 @@ pub async fn relay(mut container: io::Transport, mut server: io::Transport) {
     };
 
     let s2c = async {
-        let mut buf = [0u8; 8192];
+        let mut buf = vec![0u8; airlock_common::RELAY_CHUNK_SIZE];
         loop {
             match server.read.read(&mut buf).await {
                 Ok(0) | Err(_) => break,

app/airlock-common/src/lib.rs

@@ -40,3 +40,10 @@ pub const NETWORK_PORT: u32 = 1025;
 /// Filename of the Unix domain socket that `airlock go` creates on the host so
 /// that `airlock exec` can attach sidecar processes to the running container.
 pub const CLI_SOCK_FILENAME: &str = "cli.sock";
+
+/// Read-buffer size used by every TCP/Unix relay loop that pushes bytes
+/// into a `TcpSink.send` call. Bigger chunks mean fewer capnp messages
+/// (less framing overhead) but do not measurably improve throughput
+/// beyond this value in practice — TCP batching in the guest and
+/// host kernels already coalesces bytes before they reach a relay.
+pub const RELAY_CHUNK_SIZE: usize = 8 * 1024;

app/airlockd/src/net/host_socket_forward.rs

@@ -112,7 +112,7 @@ async fn relay(
     // Bidirectional relay: local ↔ RPC.
     // When either direction closes, clean up both sides.
     let local_to_rpc = async {
-        let mut buf = [0u8; 8192];
+        let mut buf = vec![0u8; airlock_common::RELAY_CHUNK_SIZE];
         loop {
             match local_read.read(&mut buf).await {
                 Ok(0) | Err(_) => break,

app/airlockd/src/net/rpc_bridge.rs

@@ -90,7 +90,7 @@ pub async fn relay(
     remote_rx: &mut mpsc::Receiver<Bytes>,
 ) {
     let to_remote = async {
-        let mut buf = [0u8; 8192];
+        let mut buf = vec![0u8; airlock_common::RELAY_CHUNK_SIZE];
         loop {
             match local_read.read(&mut buf).await {
                 Ok(0) => break,