Clarify and make visible that the embedded client resolves the upstream
entirely in-process. In userspace/netstack mode NetBird's DNS server runs
"via memory" (packet hooks on the netstack device), so hostname lookups go
over the tunnel and are answered from the network map with no changes to
the host resolver and no root.
Add operational visibility:
- initialize the shared NetBird logger (NB_LOG_LEVEL, default info)
- log overlay IP/FQDN, management/signal state and peer count on connect
- preflight: resolve+dial the upstream over the tunnel once at startup
- per-request access logs and per-dial resolution/connection logs
Document the resolution mechanism and troubleshooting in the README.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Add a small proof-of-concept command (client/embed/example/agentproxy)
that embeds the NetBird client in userspace/netstack mode and exposes a
local HTTP listener on 127.0.0.1:8080. Incoming requests are
reverse-proxied over the encrypted NetBird tunnel to an upstream Agent
Network endpoint (e.g. https://mirror.netbird.ai).
The embedded client authenticates like a regular client: interactive SSO
by default, or a setup key supplied via NB_SETUP_KEY. Because it runs
entirely in userspace and only binds a loopback socket, it works without
root and in rootless containers (OpenShift, Podman).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
