They wrote a blog post all about it: https://fly.io/blog/our-user-mode-wireguard-year/
They're saying Wireguard is used.
More than that. They're saying that they're running a userspace implementation of both the tcp/ip stack and wireguard. Your machine isn't a peer to the wireguard tunnel, only flyctl is.
Of course, your machine can be a peer also. You can create peers to your organization with `flyctl wireguard create`.
But that isn’t the case for all of the other uses of flyctl.
You can’t make connections with other processes over the same connection flyctl makes when it’s doing stuff.
That is what GP is saying.
Its hard for me to think of a sprawling CLI that I love.
Re:JIT WireGuard
by freedomben on Wednesday March 13, 2024 @09:59AM
(#39691288)
This basically means they are using userspace Wireguard, such as the go implementation. That is as opposed to the in-kernel wireguard.
The reason to mention conjuring a TCP IP stack out of thin air, is that most of the time the operating system is providing the tcpip stack as part of the kernel. With wireguard go, the tcpip stack is running in user space, meaning it can be created in a normal user space process such as the flyctl command line interface. This is indeed quite magical for people who have been around for many years as a usable in-process userspace tcpip stack is a relatively new and a novel thing.
I always felt weird about this, i still cant really wrap my head around userspace tcpip stacks, it just feels... weird
There was a time that's all we had when using Windows [1]. It was weird.
[1]: https://retrocomputing.stackexchange.com/questions/5891/how-...
“We’ve gone a step beyond that: every time you run flyctl, our lovable, sprawling CLI, it conjures a TCP/IP stack out of thin air, with its own IPv6 address, and speaks directly to Fly Machines running on our networks.”