Loading post…
Fly.ioExplainer
SSH and User-mode IP WireGuard
Summary
Fly.io’s SSH feature addresses the need to access applications running in Firecracker micro-VMs without requiring users to build containers with an SSH service or install WireGuard. The first part uses 6PN, a private IPv6-based network routed across Fly’s WireGuard mesh, and Hallpass, a small Go SSH server bound to each instance’s 6PN address. Authentication relies on an organization’s root SSH certificate published in private DNS, while the API signs short-lived user certificates. To support users without WireGuard installed, flyctl combines wireguard-go’s userland protocol with gVisor’s user-mode TCP/IP stack, allowing ordinary Go networking code and DNS resolution to operate over the private network. The resulting certificate-based SSH path is built into flyctl and reaches internal DNS names such as dogmatic-potato-342.internal, although the user-mode implementation is substantially slower than kernel TCP/IP.
Context
Fly did not initially provide an SSH feature because its platform focused on edge applications, but users increasingly ran complete applications and service clusters on it. Requiring customers to add an SSH service to their containers was not considered an appropriate solution, and some users also lacked WireGuard installed on their machines.
Approach / What changed
Fly starts Hallpass on each Firecracker micro-VM and binds it to the instance’s 6PN address. Organization root SSH certificates are published in private DNS, while the API signs user certificates. For clients without WireGuard, flyctl uses wireguard-go with gVisor’s user-mode TCP/IP implementation, exposing a net.Dialer and DNS resolver that operate over the private network.
Takeaways
Hallpass authenticates through short-lived SSH certificates signed by Fly’s API, with an organization-level root certificate provisioned in private DNS rather than distributing login keys to instances.
wireguard-go’s userland protocol alone does not provide TCP connectivity; combining it with gVisor’s buffer-based TCP/IP stack lets standard Go networking code communicate over the WireGuard network.
User-mode IP WireGuard is substantially slower than kernel TCP/IP, but the implementation can be used for SSH and similar tasks where installing a native WireGuard interface is impractical.
Source and freshness
- Source
- fly.io
- Published
- Added to Yomu
- Last updated
Summaries are generated from the original by a language model. Check the original before relying on it.
Keep reading
Related reading
The Good Stuff
Paid picks we use ourselves. Links carry a referral code — a subscription through one earns us a commission at no extra cost to you.
The best engineering reads, once a week
One useful email. Unsubscribe anytime.