Boxr: a pure-Rust user-mode TCP/IP stack for rootless containers

[kchaitanya863]

I've been building Boxr, a rootless OCI container engine in Rust, and the piece I'm most proud of (and most unsure about) is the networking: a user-mode TCP/IP stack written entirely in Rust, no slirp4netns, no pasta, no C dependencies.

Why? Rootless containers need a way to give the container a network without root privileges. The standard answer is slirp4netns — a separate C process you shell out to. I wanted the whole data path in one memory-safe codebase: packets go from a TUN device through my TCP state machine and out, all in Rust, all in-process.

What's implemented:

• TUN device handling and packet I/O
• TCP state machine (handshake, retransmission, teardown)
• Enough of IP/ICMP/UDP to make apt-get, curl, etc. work inside containers

What I'd love feedback on:

• The TCP state machine design — edge cases in retransmission and connection teardown are where I least trust my code
• Whether in-process vs. separate-process networking is the right call for isolation
• Async runtime choices for packet processing throughput

Honest caveats: single maintainer, beta quality, ~28k lines of Rust. boxr exec currently has a namespace bug I'm debugging. Not production-ready — I'm sharing the networking piece because the design discussion is worth having regardless.

Networking code lives under the usernet module. Happy to walk through any part of it.

Demo of the whole engine (30s): GIF in the README.