Awesome GitHub RepositoriesUserspace Network Stacks

This project is a secure container runtime that provides strong isolation for application workloads by implementing a userspace kernel. By intercepting system calls and executing them within a memory-safe, restricted environment, it minimizes the attack surface exposed to the host kernel. It functions as a drop-in engine for standard container orchestration platforms, ensuring compatibility with industry-standard runtime specifications while maintaining a hardened execution boundary. The runtime distinguishes itself through its ability to virtualize core system resources, including an indepen

ZeroTierOne is a software-defined networking engine that creates virtual local area networks by emulating Ethernet switches across distributed devices. It functions as a peer-to-peer platform, establishing encrypted tunnels directly between endpoints to bypass the need for centralized gateways or hub-and-spoke architectures. The system distinguishes itself through a decentralized approach to network discovery and identity management. By utilizing a distributed hash table and public key infrastructure, it authenticates devices and maps virtual addresses to physical endpoints without relying on

ScyllaDB is a distributed NoSQL database engine designed for high-throughput data storage and low-latency performance at scale. It functions as a shard-aware platform that manages large-scale datasets across distributed clusters, providing a foundation for real-time applications that require consistent availability and operational stability. The system distinguishes itself through a shared-nothing architecture that distributes data across independent CPU cores to eliminate lock contention. It incorporates a user-space networking stack and an asynchronous event-driven engine to maximize hardwa

Seastar is a C++ server application framework and asynchronous programming library designed for building high-performance, shared-nothing server applications. It functions as a high-performance I/O engine providing direct disk and network access through a shared-nothing framework that partitions data and execution across CPU cores. The framework distinguishes itself through a thread-per-core architecture that eliminates locking and resource contention by assigning one execution thread to each physical CPU core. It implements a userspace TCP/IP stack and kernel-bypass techniques, integrating w

Firejail is a Linux application sandbox and kernel security wrapper that isolates untrusted applications from the host system. It uses kernel namespaces and seccomp filters to restrict filesystem access, drop kernel capabilities, and limit the system attack surface. The project is distinguished by its use of predefined security profiles to automatically apply filesystem restrictions and syscall limits based on the executable being launched. It provides specialized isolation for portable packages such as AppImages and implements X11 display isolation via proxy servers to prevent keyboard loggi

ByeByeDPI is a network utility designed to circumvent regional blocking and censorship by evading deep packet inspection. It functions as a traffic tunnel and local SOCKS5 proxy server that modifies network packets to prevent filters from identifying and blocking specific content. The project employs a user-mode network stack to manipulate traffic at the application level. It achieves bypass capabilities through TCP packet fragmentation and the modification of HTTP request header formatting and case sensitivity. The system includes application-level tunneling control to determine which progr

Ligolo-ng is a network tunneling framework and control server designed for managing remote agents and coordinating network routing. It functions as a reverse tunneling proxy and a site-to-site VPN tool, utilizing a userland TUN interface to pivot network traffic through remote agents. The project distinguishes itself by using a TUN interface routing system to forward TCP, UDP, and ICMP traffic through multiple remote agents. It implements a C2 model where a central server manages remote agents to bypass firewall restrictions and provide direct subnet access to isolated networks. The system c

wireguard-go is a Go implementation of the WireGuard protocol that operates as a userspace tunneling engine. It functions as a cross-platform network interface designed to establish encrypted tunnels between peers without requiring modifications to the system kernel. By implementing the protocol in userspace, this project provides a consistent network stack that enables secure peer-to-peer communication across different operating systems. It allows for the creation and management of encrypted network interfaces and tunnels to route private traffic over public networks.

RootlessKit is a tool for running container workloads and isolated process trees securely as a standard non-privileged user without holding root access on the host. It creates unprivileged user and mount namespaces to simulate fake root execution environments, allowing users to execute container workloads and manage resource groups safely. The project provides capabilities for rootless port forwarding and unprivileged network namespace isolation, routing container network traffic through user-mode packet translation without requiring privileged kernel setup. It includes multiple backend netwo

Dpdk-ans is a high-performance userspace networking library and TCP/IP stack built on the Data Plane Development Kit. It implements a userspace network protocol stack that bypasses operating system kernel overhead and interacts directly with network interface hardware using poll mode drivers without interrupts. The project provides BSD-compatible socket APIs to enable legacy network applications to operate without requiring source code modifications. It supports multi-core receive scaling and traffic distribution to assign incoming network flows across dedicated CPU cores using hashing, alon