net

package

v0.0.0-...-3476652 Latest Latest Go to latest Published: Nov 15, 2026 License: Apache-2.0, BSD-3-Clause, MIT Imports: 29 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/google/gvisor

Links

Open Source Insights

Documentation ¶

Overview ¶

Package net implements the netgofer sidecar network proxy.

Constants ¶

View Source

const (
	// DefaultMTU is the MTU assumed for a network link when none is otherwise
	// known. It matches the conventional Ethernet MTU.
	DefaultMTU = 1500
)

Variables ¶

This section is empty.

Functions ¶

This section is empty.

Types ¶

type Netgofer ¶

type Netgofer struct {
	util.InternalSubCommand
	// contains filtered or unexported fields
}

Netgofer implements subcommands.Command for the "netgofer" command.

netgofer acts as a network proxy for gVisor sandboxes (runsc) to proxy network traffic over a unix domain socket (UDS) connection. It should not be called directly.

It runs a user-space netstack to proxy outbound TCP and UDP traffic and intercepts traffic from the sandbox and forwards it to the host network via host sockets (translating source IP to host/pod IP).

Limitations:

Only outbound TCP and UDP traffic is supported. ICMP and inbound connections are not supported.
Link-local destinations (169.254.0.0/16 and fe80::/10, including GCE metadata DNS 169.254.169.254 and NodeLocal DNSCache 169.254.20.10) are blocked by the egress filter.
Network connection preservation across save/restore is not supported, existing connections will be reset upon restore.

func (*Netgofer) Execute ¶

func (n *Netgofer) Execute(_ context.Context, f *flag.FlagSet, args ...any) subcommands.ExitStatus

Execute implements subcommands.Command.

func (*Netgofer) Name ¶

func (*Netgofer) Name() string

Name implements subcommands.Command.

func (*Netgofer) SetFlags ¶

func (n *Netgofer) SetFlags(f *flag.FlagSet)

SetFlags implements subcommands.Command.

func (*Netgofer) Synopsis ¶

func (*Netgofer) Synopsis() string

Synopsis implements subcommands.Command.

func (*Netgofer) Usage ¶

func (*Netgofer) Usage() string

Usage implements subcommands.Command.

Source Files ¶

View all Source files

netgofer.go

Directories ¶

Path	Synopsis
egressfilter Package egressfilter validates outbound traffic destinations for netgofer, enforcing invariants such as loopback, multicast, link-local, broadcast, and host network interface protection.	Package egressfilter validates outbound traffic destinations for netgofer, enforcing invariants such as loopback, multicast, link-local, broadcast, and host network interface protection.
filter Package filter defines all syscalls the netgofer is allowed to make, and installs seccomp filters to prevent prohibited syscalls in case it's compromised.	Package filter defines all syscalls the netgofer is allowed to make, and installs seccomp filters to prevent prohibited syscalls in case it's compromised.
config Package config defines all syscalls the netgofer is allowed to make to the host.	Package config defines all syscalls the netgofer is allowed to make to the host.

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL