Maycon Santos 66a28fd666 [client] Add nblink, an unprivileged forwarder into the network (#7955) ...

Reaching an internal service meant installing the agent, which needs root
for a TUN device. nblink runs the embedded client in netstack mode and
forwards local HTTP listeners to upstreams inside the tunnel, so it works on
managed machines and in rootless containers. Upstream names resolve
in-process.

Forwards bind loopback unless --allow-public-bind is given. The listener
refuses rebound and cross-site browser requests and bounds stalled request
bodies. It ships as release archives and a distroless image that runs under
an arbitrary UID.

An embedded client given no StatePath now keeps its state in memory rather
than falling back to the installed agent's state file, which every embedded
client in a proxy process also shared. The state manager gets an explicit
in-memory store for it.

2026-10-12 13:54:15 +02:00

..

nblink

[client] Add nblink, an unprivileged forwarder into the network (#7955)

2026-10-12 13:54:15 +02:00