Our User-Mode WireGuard Year (fly.io)

Article summary

Fly.io, a platform that runs container images on hardware around the world, uses WireGuard as a fundamental component of its infrastructure. The company developed a user-mode WireGuard implementation that allows users to access their applications without requiring root access. This implementation has enabled features such as SSH access and remote builds, but has also presented challenges such as slow peer creation and potential connectivity issues. The company has made improvements to its implementation, including reducing the time it takes to create new WireGuard peers.

Main themes

• WireGuard implementation
• user-mode TCP/IP stacks
• security implications
• infrastructure innovation
• scalability and reliability
• network policy restrictions
• key rotation and performance
• remote builds and SSH access

What commenters say

• The use of WireGuard as a transport protocol is interesting, but the real innovation is running TCP/IP over it in userland.
• The implementation of user-mode TCP/IP stacks is not new, but it is uncommon in practice and has potential benefits and drawbacks.
• The use of WireGuard has advantages over traditional SSL/TLS, such as easier key rotation and better performance.
• Some commenters are concerned about the potential security implications of using WireGuard and user-mode TCP/IP stacks.
• The implementation of WireGuard and user-mode TCP/IP stacks has enabled new features and use cases, such as remote builds and SSH access.
• There are potential issues with the scalability and reliability of the WireGuard implementation, particularly in environments with restrictive network policies.
• The company's approach to infrastructure and security is seen as innovative and refreshing by some commenters.
• Others are concerned about the potential risks and limitations of the approach, particularly in terms of security and scalability.