docs(e2e): update client/compose comments for the TUN architecture

The e2e client headers and compose comments still described the removed SOCKS/HTTP
proxies + LD_PRELOAD hook + seccomp supervisor. Rewrite them: plug captures at the
IP layer via its userspace TUN, so each client reaches the cluster service by name
through its natural driver, no proxy or hook. Comments only — no code or compose
directive changed (obsolete PLUG_HOOK_DEBUG / seccomp:unconfined / SYS_PTRACE left
in place, to drop separately once the e2e is re-run without them).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: hhfrancois

e2e/clients/go/main.go

@@ -1,9 +1,11 @@
 // The Go e2e client: reach a cluster service BY NAME, by protocol, using the
 // language's NATURAL driver. Invoked (under plug) as:  eclient <proto> <host:port>
 //
-// http goes through Go's net/http (honors HTTP_PROXY → exercises the proxy path);
-// every other protocol is a raw-TCP driver (no proxy honoring) → it exercises the
-// seccomp supervisor. Prints "E2E-OK <proto> — …" and exits 0 on success.
+// Every protocol just connects to <host:port> by name and lets the driver do its
+// thing: no proxy, no hook, no config. plug captures at the IP layer through its
+// userspace TUN, so the app's socket is never touched and each driver reaches the
+// cluster service by name uniformly. Prints "E2E-OK <proto> — …" and exits 0 on
+// success.
 package main
 
 import (
@@ -244,7 +246,8 @@ func doMQTT(target string) {
 }
 
 func doGRPC(target string) {
-	// WithNoProxy → raw TCP (HTTP/2), so this exercises the seccomp supervisor.
+	// Plain HTTP/2 to <host:port> by name — plug captures it at the IP layer, no
+	// proxy involved.
 	conn, err := grpc.NewClient(target,
 		grpc.WithTransportCredentials(insecure.NewCredentials()), grpc.WithNoProxy())
 	if err != nil {

e2e/clients/java/src/main/java/io/plug/e2e/Client.java

@@ -2,10 +2,10 @@
 // language's NATURAL driver. Invoked (under plug) as:
 //     java -jar /app/client.jar <proto> <host:port>
 //
-// http goes through java.net.http.HttpClient; every other protocol is a raw-TCP
-// driver. plug sets JAVA_TOOL_OPTIONS=-DsocksProxyHost=... -DsocksProxyPort=...
-// so the JVM routes all TCP through plug's SOCKS proxy automatically — this code
-// does NOT configure any proxy, it just connects to <host:port> by name.
+// Every protocol just connects to <host:port> by name and lets the driver do its
+// thing: no proxy, no hook, no config. plug captures at the IP layer through its
+// userspace TUN, so the JVM's socket is never touched and each driver reaches the
+// cluster service by name uniformly.
 //
 // Prints "E2E-OK <proto> — …" and exits 0 on success, or
 // "E2E-FAIL <proto> <error>" and exits 1 on failure. A bash harness greps these.

e2e/clients/node/client.js

@@ -2,11 +2,11 @@
 // the language's NATURAL driver. Invoked (under plug) as:
 //   node /app/client.js <proto> <host:port>
 //
-// http goes through Node's built-in `http` module (http.get resolves through
-// libc, which plug's hook covers — do NOT use fetch/undici, it ignores proxy
-// env); every other protocol is a raw-TCP driver → it exercises the seccomp
-// supervisor. Prints "E2E-OK <proto> — …" and exits 0 on success, otherwise
-// prints "E2E-FAIL <proto> <error>" and exits non-zero.
+// Every protocol just connects to <host:port> by name and lets the driver do its
+// thing: no proxy, no hook, no config. plug captures at the IP layer through its
+// userspace TUN, so the app's socket is never touched and each driver reaches the
+// cluster service by name uniformly. Prints "E2E-OK <proto> — …" and exits 0 on
+// success, otherwise prints "E2E-FAIL <proto> <error>" and exits non-zero.
 
 'use strict';
 

e2e/clients/python/client.py

@@ -2,9 +2,10 @@
 # The Python e2e client: reach a cluster service BY NAME, by protocol, using the
 # language's NATURAL driver. Invoked (under plug) as:  python client.py <proto> <host:port>
 #
-# http goes through requests / urllib3 (honors HTTP_PROXY -> exercises the proxy
-# path); every other protocol is a raw-TCP driver (no proxy honoring) -> it
-# exercises the seccomp supervisor. Prints "E2E-OK <proto> - ..." and exits 0 on
+# Every protocol just connects to <host:port> by name and lets the driver do its
+# thing: no proxy, no hook, no config. plug captures at the IP layer through its
+# userspace TUN, so the app's socket is never touched and each driver reaches the
+# cluster service by name uniformly. Prints "E2E-OK <proto> - ..." and exits 0 on
 # success, "E2E-FAIL <proto> <error>" and exits 1 on failure.
 import sys
 import time

e2e/compose.yml

@@ -74,9 +74,11 @@ services:
     networks: [internal]
 
   # ---- language clients (run on demand: `<proto> <host:port>` as args) ----
-  # Each runs its command UNDER plug against the cluster service by name. The
-  # seccomp flags are only needed INSIDE a container (a real host needs neither);
-  # they let plug's Go-coverage supervisor install a user-notifier + read its child.
+  # Each runs its command UNDER plug against the cluster service by name. plug
+  # captures at the IP layer through its userspace TUN, so the client reaches the
+  # service by its natural driver — no proxy, no hook. The caps/devices below are
+  # only needed INSIDE a container (a real host needs none): NET_ADMIN + SYS_ADMIN
+  # + /dev/net/tun let plug create the TUN, set routes, and repoint DNS.
   client-go:
     build: { context: ., dockerfile: clients/go/Dockerfile }
     networks: [edge]