Why I Put a TCP/IP Stack Inside a Rootless Container Engine
Inside Boxr’s pure-Rust UserNet: TAP frames, ARP, DNS, TCP proxying, and the trade-offs that keep it beta. Rootless containers have a networking problem that looks simple until you follow the packet. Creating an isolated network namespace is only the first step. The application inside the container still expects DNS, outbound TCP, port forwarding, and behavior close enough to a normal Linux host…
Boxr's UserNet project aims to embed a networking stack inside a rootless container runtime written in Rust. While rootless containers have a networking problem, the application inside the container still requires DNS, outbound TCP, port forwarding, and normal Linux host behavior. The container needs a way to communicate with the host network without relying on host root privileges.
Boxr offers several network modes: Auto, UserNet, Pasta, Bridge, host, and none. UserNet is an embedded Layer 2 through Layer 4 data path that provides a small virtual network, handling ARP, ICMP, and DNS functions. TCP is the most complex part, and the current implementation focuses on connection setup and teardown, sequence numbers, and data translation. The project is labeled beta due to the limited TCP capabilities.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
