Skip to content

Implement proxy mount read caching#751

Open
scuffi wants to merge 4 commits into
mainfrom
improve-mount-proxy-read
Open

Implement proxy mount read caching#751
scuffi wants to merge 4 commits into
mainfrom
improve-mount-proxy-read

Conversation

@scuffi

@scuffi scuffi commented Jun 11, 2026

Copy link
Copy Markdown
Contributor

Summary

Reduce redundant upstream requests during credential-proxy mounted reads by adding a short-lived HEAD metadata response cache.

s3fs issues frequent HEAD requests for metadata (getattr) on every file open, stat, and read. With credential-proxy mounts, each HEAD request was forwarded upstream through the signing proxy, adding latency to repeated reads. This PR keeps the existing aws4fetch/AwsClient signing path and focuses the optimization on safe metadata caching.

Changes

HEAD metadata cache (s3-credential-proxy-handler.ts)

  • Positive cache: Cache successful HEAD responses for 60s.
  • Negative cache: Cache 404 HEAD responses for 5s to avoid repeated existence checks for non-existent paths (s3fs probes path/, path_$folder$ variants).
  • PUT priming: After a successful PUT, synthesize and cache a HEAD-equivalent entry from request/response metadata such as content-length, content-type, etag, last-modified, and x-amz-meta-*.
  • Conservative bypasses: Do not cache ranged, conditional, checksum-mode, SSE-C, or GCS customer-encryption HEAD requests.
  • Selective invalidation: Mutating methods (PUT, POST, DELETE) invalidate cached metadata. GET requests preserve cached metadata.
  • Copy/multipart safety: Do not prime from query-string PUTs or copy operations; multipart/query mutations invalidate affected metadata.
  • Size bound: Cache is limited to 1,000 entries with TTL-aware eviction, falling back to FIFO eviction if still over limit.

Cache lifecycle (sandbox.ts)

  • evictHeadMetadataCacheForMount is called during unmount, mount-failure cleanup, and sandbox teardown, matching the existing SigV4 client and directory-marker cache cleanup paths.

Request forwarding safety

  • Strip hop-by-hop/proxy headers before forwarding credential-proxy requests upstream.
  • Preserve SigV4 request bodies that do not include content-length instead of dropping the stream.
  • Keep SigV4 signing on the existing aws4fetch AwsClient path.

Benchmark results (from repro)

Step Direct S3 Credential Proxy Delta
read-small (1 KiB) 133ms 206ms +73ms
read-large (512 KiB) 69ms 100ms +31ms
read-large-repeat (5x) 388ms 285ms -103ms
cached-head 20x reads 2102ms 1297ms -805ms
list-files 1898ms 107ms -1791ms

Credential-proxy now avoids redundant upstream HEAD requests on repeated metadata reads.

@changeset-bot

changeset-bot Bot commented Jun 11, 2026

Copy link
Copy Markdown

🦋 Changeset detected

Latest commit: 9b670bf

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package
Name Type
@cloudflare/sandbox Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

@pkg-pr-new

pkg-pr-new Bot commented Jun 11, 2026

Copy link
Copy Markdown

Open in StackBlitz

npm i https://pkg.pr.new/cloudflare/sandbox-sdk/@cloudflare/sandbox@751

commit: 9b670bf

@github-actions

github-actions Bot commented Jun 11, 2026

Copy link
Copy Markdown
Contributor

📦 Preview Build

Version: 0.0.0-pr-751-9b670bfd

Install the SDK preview:

npm i https://pkg.pr.new/cloudflare/sandbox-sdk/@cloudflare/sandbox@751

🐳 Docker images were not rebuilt — no container changes detected. Use the latest release images from Docker Hub.

scuffi added 3 commits June 16, 2026 15:40
Keep the established SigV4 signer for credential-proxy mounts while
retaining the metadata cache behavior. This keeps the cache change focused
on reducing redundant HEAD requests without expanding signing risk.
@scuffi scuffi marked this pull request as ready for review June 18, 2026 10:25

@devin-ai-integration devin-ai-integration Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.

Open in Devin Review

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant