squid: cap inherited file descriptor limit

[mxschmitt]

Summary

Squid can inherit an unexpectedly large RLIMIT_NOFILE when it is launched in an Apple container Kubernetes node. Squid then allocates descriptor-indexed state based on that limit and can consume excessive memory, destabilizing the single-node cluster and making the Kubernetes API time out.

This PR adds a small entrypoint that caps the inherited soft and hard descriptor limit at 65536 before starting Squid.

It also removes the unavailable Alpine package pin (squid=7.5-r0). Current Alpine repositories provide Squid 7.6-r0; the entrypoint workaround is therefore usable with the current package while squid-cache/squid#2483 is pending.

Changes

• Add squid/entrypoint.sh.
• Set ulimit -n 65536 before exec squid.
• Use the current Alpine Squid package with apk add --no-cache squid.
• Preserve the existing Squid configuration and command-line options.

Validation

Tested on an ARM64 Apple container Kubernetes cluster:

• The unmodified image reproduced the failure: a minimal Squid Deployment caused Kubernetes API requests to time out shortly after startup.

• The image built from this branch stayed 1/1 Running across repeated readiness checks, with the Kubernetes API /readyz remaining ok.

• In the full try-playwright deployment, Squid rolled out successfully and /proc/1/limits reported:

  Max open files 65536 65536 files
  

• JavaScript Playwright API tests passed against the deployed stack.

This is intentionally a distribution-level workaround until the upstream Squid fix is available.