undefined | Better HN

0 pointsconradev3mo ago0 comments

Tor does this the right way on Linux. You make a separate user namespace with access only to the WireGuard network adapter and run the program inside of that. You want the kernel involved if you want any sort of guarantee:

https://blog.torproject.org/introducing-oniux-tor-isolation-...

0 comments

throwaway8943453mo ago

How does this work in something like Kubernetes where you have a sidebar container configuring the network for the main container without affecting others on the same host?

conradevOP3mo ago

I think all containers share the same netns in a pod. You restrict the pod to only the Wireguard peer IP, and have a (NET_ADMIN) sidecar container create an interface (tun/kernel wg) and update the routing tables for the netns. Then I believe the traffic from the other containers in the pod is tunneled.

j / k navigate · click thread line to collapse

0 pointsconradev3mo ago0 comments

https://blog.torproject.org/introducing-oniux-tor-isolation-...

0 comments

throwaway8943453mo ago

How does this work in something like Kubernetes where you have a sidebar container configuring the network for the main container without affecting others on the same host?

conradevOP3mo ago

j / k navigate · click thread line to collapse