fix(envd): guard MMDS-poll goroutine with CAS to prevent unbounded accumulation on /init retries

packages/envd/internal/api/init.go

@@ -206,11 +206,19 @@ func (a *API) PostInit(w http.ResponseWriter, r *http.Request) {
 		a.initialized.Store(true)
 	}
 
-	go func() { //nolint:contextcheck // TODO: fix this later
-		ctx, cancel := context.WithTimeout(context.Background(), 60*time.Second)
-		defer cancel()
-		host.PollForMMDSOpts(ctx, a.mmdsChan, a.defaults.EnvVars)
-	}()
+	// Only one MMDS-poll goroutine may be in flight at a time. Without this
+	// guard every /init retry (the orchestrator retries with infinite backoff
+	// until the sandbox responds) spawns a fresh goroutine that lives for 60 s
+	// and fires up to 1 200 HTTP requests — O(N) goroutines and O(N*1200)
+	// connections accumulate silently until they time out.
+	if a.mmdsPollRunning.CompareAndSwap(false, true) {
+		go func() { //nolint:contextcheck
+			ctx, cancel := context.WithTimeout(context.Background(), 60*time.Second)
+			defer cancel()
+			host.PollForMMDSOpts(ctx, a.mmdsChan, a.defaults.EnvVars)
+			a.mmdsPollRunning.Store(false)
+		}()
+	}
 
 	w.Header().Set("Cache-Control", "no-store")
 

packages/envd/internal/api/store.go

@@ -66,6 +66,13 @@ type API struct {
 	// re-adopted (possibly hostile) guest process can neither drive an upgrade
 	// nor be handed a running workload before /init has re-established auth.
 	initialized atomic.Bool
+
+	// mmdsPollRunning is set to true while a PollForMMDSOpts goroutine is
+	// in flight. CompareAndSwap on this flag prevents PostInit from spawning
+	// a new polling goroutine on every /init retry — each goroutine sends up
+	// to 1200 HTTP requests over its 60 s lifetime, so N concurrent retries
+	// would produce O(N*1200) MMDS calls and O(N) goroutine stack allocations.
+	mmdsPollRunning atomic.Bool
 }
 
 // Initialized reports whether the first authenticated /init has completed.