Hi, Each Wireguard device remembers the network namespace in which it was created. In the documentation this is called the birthplace namespace [1] but I'll be calling it the transit namespace.
Let's say I create a Wireguard device `wg0` in a network namespace called `vpn`. Then I would like to be able to run # wg set wg0 transit-namespace /proc/1/ns/net to change the Wireguard UDP socket to live in the init namespace. This has the following advantages over creating the device in the init namespace and then moving it to the `vpn` namespace: * If multiple processes are creating Wireguard devices at the same time, then their device namespaces are isolated as long as each process uses its own network namespace. This means that there is no problem if two processes try to create the `wg0` device at the same time. * The intention is for the `wg0` device to be used only within the `vpn` namespace. It does not feel clean that the device has to live in the init namespace for an arbitrarily short but non-zero amount of time. This also leaks the existence of the `wg0` device to all processes living in the init namespace. Could such a feature be implemented? Julian [1] https://www.wireguard.com/netns/ _______________________________________________ WireGuard mailing list [email protected] https://lists.zx2c4.com/mailman/listinfo/wireguard
