This is extremely cool. The basic idea: WireGuard is just a network protocol, like any other, and you can drive it from unprivileged userland code… which means you can drive all of TCP/IP from unprivileged userland code, through WireGuard.
https://twitter.com/mrkurt/status/1349772632133087235
Why would you ever want to do that? Well, we expose services on Fly.io over WireGuard (and, for security, over no other interfaces) but not all of our users are going to install OS WireGuard.
But: all of our users have our (Golang) `flyctl` installed, and flyctl can do WireGuard via wireguard-go, and then userland TCP/IP, to be a client of a network service exposed over WireGuard, without installing WireGuard itself.
Obviously, you should just install WireGuard. But for the stuff I’m talking about, perf doesn’t really matter (if it does, again, install WireGuard), and convenience really matters a lot.
• • •
Missing some Tweet in this thread? You can try to
force a refresh
