3 ms·
There's some similarities and differences, instead of going through a TUN/TAP device each application communicates directly to the mesh with it's own userspace
by dpeckett 3y ago
There's some similarities and differences, instead of going through a TUN/TAP device each application communicates directly to the mesh with it's own userspace TCP/IP stack (and also retains compatibility with wireguard).
- radlad 3y ago(I am a Nebula maintainer.) We recently merged support for gVisor-based services, although it's very new, and I don't know of much experimentation that's been done with it yet: https://github.com/slackhq/nebula/pull/965 https://github.com/slackhq/nebula/pull/965
- dpeckett 3y agoReally cool! I guess that there's little differences other than noisysockets is explicitly WireGuard compatible (but I actually prefer Nebulas tweaks to the wire protocol). I actually had some folks from OpenZiti reach out and they have another similar tool in this space.
- PLG88 3y agoSome similarities: though when app embedded we are not using a user space TCP stack, we have a suite of SDKs so that you can embed the ingress/egress, authentication, mTLS, E2EE, etc directly into your app, really easily - https://openziti.io/docs/reference/developer/sdk/ https://openziti.io/docs/reference/developer/sdk/. When using the Ziti tunnelers on host OS we use a TCP stack.