TE
科技回声
首页24小时热榜最新最佳问答展示工作
GitHubTwitter
首页

科技回声

基于 Next.js 构建的科技新闻平台,提供全球科技新闻和讨论内容。

GitHubTwitter

首页

首页最新最佳问答展示工作

资源链接

HackerNews API原版 HackerNewsNext.js

© 2025 科技回声. 版权所有。

We improved the performance of a userspace TCP stack in Go

226 点作者 infomaniac12 个月前

13 条评论

dpeckett12 个月前
Really cool to see others hacking on netstack, bit of a shame it&#x27;s tied up in the gVisor monorepo (and all the Bazel idiosyncracies) but it&#x27;s a very neat piece of kit.<p>I&#x27;ve actually been hacking on a similar FOSS project lately, with a focus on building what I&#x27;m calling a layer 3 service mesh for the edge. More or less came out of my learned hatred for managing mTLS at scale and my dislike for shoving everything through a L7 proxy (insane protocol complexity, weird bugs, and you still have the issue of authenticating you are actually talking to the proxy you expect).<p>Last week I got the first release of the userspace router shipped, worth taking a look if you want to play around with a completely userspace and unprivileged WireGuard compatible VPN server.<p><a href="https:&#x2F;&#x2F;github.com&#x2F;noisysockets&#x2F;nsh&#x2F;blob&#x2F;main&#x2F;docs&#x2F;router.md">https:&#x2F;&#x2F;github.com&#x2F;noisysockets&#x2F;nsh&#x2F;blob&#x2F;main&#x2F;docs&#x2F;router.md</a>
评论 #40589887 未加载
zxt_tzx11 个月前
I met one of the founders of Coder.com, he&#x27;s a really cool dude. It&#x27;s a pity that it is a product aimed more at enterprises than individual developers, else it would have far more developer mindshare.<p>Unlike, say, GitHub Codespaces, running something like this on your own infra means your incentives and Coder.com&#x27;s are aligned, i.e. both of you want to reduce your cloud costs (as opposed to, say, GitHub running on Azure gives them an opportunity and incentive to mark up on Azure cloud costs).
评论 #40594899 未加载
wmf12 个月前
&quot;Asking for elevated permissions inside secure clusters at regulated financial enterprises or top secret government networks is at best a big delay and at worst a nonstarter.&quot;<p>But exfiltrating data with a userspace VPN is totally fine?<p>I&#x27;m also wondering why not use TLS.
评论 #40588543 未加载
评论 #40592030 未加载
评论 #40592031 未加载
评论 #40587994 未加载
parhamn12 个月前
I don&#x27;t know anything about Coder, but Gvisor proliferation is annoying. It&#x27;s a boon for cloud providers, helping them find another way to get a large multiple performance decrease per dollar spent in exchange for questionable security benefits. And I&#x27;m seeing it everywhere now.
评论 #40590873 未加载
评论 #40588958 未加载
评论 #40588906 未加载
评论 #40589930 未加载
raggi12 个月前
It&#x27;s great to see this, I know the team went on a long journey through this and the blog makes it almost look shorter and simpler than it was. I&#x27;m hoping one day we can all integrate the support for GSO that&#x27;s been landing in gvisor too, but so far we&#x27;ve (tailscale) not had a chance to look deeply into that yet. It was really effective for our tun and UDP interfaces though.
评论 #40595771 未加载
评论 #40592495 未加载
pantalaimon12 个月前
The obvious question is: How does it compare to the in-Kernel TCP stack?
评论 #40592119 未加载
评论 #40588459 未加载
jiveturkey11 个月前
help me understand something.<p>&gt; we’d need a way for the TCP packets to get from the operating system back into Coder for encryption.<p>yes, this is commonly done via OpenSSL for example.<p>&gt; This is called a TUN device in unix-style operating systems and creating one requires elevated permissions<p>waitasec, wut? sure you could use a TUN device I guess, but assuming some kind of multi-tenant separation is an underlying assumption they didn&#x27;t mention in their intro, couldn&#x27;t you also use cgroup&#x27;d containers? sorry if I&#x27;m not fluent in the terminology.<p>i&#x27;m struggling to understand the constraints that push them towards gVisor. simply needing to do encryption doesn&#x27;t seem like justification. i&#x27;m sure they have very good reasons, but needing to satisfy a financial regulator seems orthogonal at best. i would just like to understand those reasons.
nynx12 个月前
Doesn’t creating a raw socket need elevated permissions?
评论 #40588569 未加载
convolvatron12 个月前
is this part of the open source releases? I looked at the coder.com github, but couldn&#x27;t find it. I haven&#x27;t written a compatible TCP, but a different reliable transport in go userspace. fairness aside, i wonder why we dont see this more often. would love to take a look
评论 #40588327 未加载
andrewstuart12 个月前
If you’re tunneling a better connection configuration isn’t the tunnel what defines the latency?
andrewstuart12 个月前
I have a problem right now which is that it’s slow to copy large files from one side of the earth to the other. Is this the basis of a solution to that maybe?
评论 #40588829 未加载
评论 #40588755 未加载
评论 #40592196 未加载
jijji12 个月前
it&#x27;s a solution looking for a problem
评论 #40592831 未加载
评论 #40589759 未加载
yencabulator11 个月前
tl;dr Increased TCP receive buffer size, implemented HyStart instead of traditional TCP slow start in gVisor&#x27;s netstack, changed an in-process packet queue from drop-when-full to block-when-full.