{"id":40596642,"url":"https://github.com/qemus/passt","last_synced_at":"2026-06-13T07:01:29.792Z","repository":{"id":318590236,"uuid":"1069339243","full_name":"qemus/passt","owner":"qemus","description":"User-mode networking for virtual machines.","archived":false,"fork":false,"pushed_at":"2026-06-13T03:22:06.000Z","size":3930,"stargazers_count":10,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"master","last_synced_at":"2026-06-13T05:12:23.528Z","etag":null,"topics":["network","networking","user-mode","user-mode-linux"],"latest_commit_sha":null,"homepage":"","language":"C","has_issues":false,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/qemus.png","metadata":{"files":{"readme":".github/readme.md","changelog":null,"contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSES/BSD-3-Clause.txt","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2025-10-03T19:18:34.000Z","updated_at":"2026-06-12T19:22:46.000Z","dependencies_parsed_at":"2025-10-28T04:16:04.395Z","dependency_job_id":null,"html_url":"https://github.com/qemus/passt","commit_stats":null,"previous_names":["qemus/passt"],"tags_count":6,"template":false,"template_full_name":null,"purl":"pkg:github/qemus/passt","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/qemus%2Fpasst","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/qemus%2Fpasst/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/qemus%2Fpasst/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/qemus%2Fpasst/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/qemus","download_url":"https://codeload.github.com/qemus/passt/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/qemus%2Fpasst/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":34275068,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-26T15:22:16.424Z","status":"online","status_checked_at":"2026-06-13T02:00:06.617Z","response_time":62,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["network","networking","user-mode","user-mode-linux"],"created_at":"2026-01-21T04:03:13.042Z","updated_at":"2026-06-13T07:01:29.773Z","avatar_url":"https://github.com/qemus.png","language":"C","funding_links":[],"categories":[],"sub_categories":[],"readme":"\u003cdiv align=\"center\"\u003e\n\u003ca href=\"https://github.com/qemus/passt\"\u003e\u003cimg src=\"https://raw.githubusercontent.com/qemus/passt/master/.github/logo.png\" title=\"Logo\" style=\"max-width:100%;\" width=\"128\" /\u003e\u003c/a\u003e\n\u003c/div\u003e\n\u003cdiv align=\"center\"\u003e\n  \n[![Build]][build_url]\n[![Version]][release_url]\n[![Size]][release_url]\n\n\u003c/div\u003e\n\nPrebuilt packages of [Passt](https://passt.top), a tool that provides user-mode networking for virtual machines.\n\n**Beware**: Unlike the the official distribution, the binaries in these packages have all their isolation features removed, as those are incompatible with Docker's default security policies. So only use them inside a Docker container, otherwise just use the official ones.\n\n# passt: Plug A Simple Socket Transport\n\n_passt_ implements a translation layer between a Layer-2 network interface and\nnative Layer-4 sockets (TCP, UDP, ICMP/ICMPv6 echo) on a host. It doesn't\nrequire any capabilities or privileges, and it can be used as a simple\nreplacement for Slirp.\n\n# pasta: Pack A Subtle Tap Abstraction\n\n_pasta_ (same binary as _passt_, different command) offers equivalent\nfunctionality, for network namespaces: traffic is forwarded using a tap\ninterface inside the namespace, without the need to create further interfaces on\nthe host, hence not requiring any capabilities or privileges.\n\nIt also implements a tap bypass path for local connections: packets with a local\ndestination address are moved directly between Layer-4 sockets, avoiding Layer-2\ntranslations, using the _splice_(2) and _recvmmsg_(2)/_sendmmsg_(2) system calls\nfor TCP and UDP, respectively.\n\n- [Motivation](#motivation)\n- [Features](#features)\n- [Interfaces and Environment](#interfaces-and-environment)\n- [Services](#services)\n- [Addresses](#addresses)\n- [Protocols](#protocols)\n- [Ports](#ports)\n- [Demo](#demo)\n- [Continuous Integration](#continuous-integration)\n- [Performance](#performance_1)\n- [Try it](#try-it)\n- [Contribute](#contribute)\n- [Security and Vulnerability Reports](#security-and-vulnerability-reports)\n\nSee also the [man page](/builds/latest/web/passt.1.html).\n\n## Motivation\n\n### passt\n\nWhen container workloads are moved to virtual machines, the network traffic is\ntypically forwarded by interfaces operating at data link level. Some components\nin the containers ecosystem (such as _service meshes_), however, expect\napplications to run locally, with visible sockets and processes, for the\npurposes of socket redirection, monitoring, port mapping.\n\nTo solve this issue, user mode networking, as provided e.g. by _libslirp_,\ncan be used. Existing solutions implement a full TCP/IP stack, replaying traffic\non sockets that are local to the pod of the service mesh. This creates the\nillusion of application processes running on the same host, eventually separated\nby user namespaces.\n\nWhile being almost transparent to the service mesh infrastructure, that kind of\nsolution comes with a number of downsides:\n\n* three different TCP/IP stacks (guest, adaptation and host) need to be\n  traversed for every service request\n* addressing needs to be coordinated to create the pretense of consistent\n  addresses and routes between guest and host environments. This typically needs\n  a NAT with masquerading, or some form of packet bridging\n* the traffic seen by the service mesh and observable externally is a distant\n  replica of the packets forwarded to and from the guest environment:\n  * TCP congestion windows and network buffering mechanisms in general operate\n    differently from what would be naturally expected by the application\n  * protocols carrying addressing information might pose additional challenges,\n    as the applications don't see the same set of addresses and routes as they\n    would if deployed with regular containers\n\n_passt_ implements a thinner layer between guest and host, that only implements\nwhat's strictly needed to pretend processes are running locally. The TCP\nadaptation doesn't keep per-connection packet buffers, and reflects observed\nsending windows and acknowledgements between the two sides. This TCP adaptation\nis needed as _passt_ runs without the `CAP_NET_RAW` capability: it can't create\nraw IP sockets on the pod, and therefore needs to map packets at Layer-2 to\nLayer-4 sockets offered by the host kernel.\n\nSee also a\n[detailed illustration](https://gitlab.com/abologna/kubevirt-and-kvm/-/blob/master/Networking.md)\nof the problem and what lead to this approach.\n\n### pasta\n\nOn Linux, regular users can create network namespaces and run application\nservices inside them. However, connecting namespaces to other namespaces and to\nexternal hosts requires the creation of network interfaces, such as `veth`\npairs, which needs in turn elevated privileges or the `CAP_NET_ADMIN`\ncapability. _pasta_, similarly to _slirp4netns_, solves this problem by creating\na tap interface available to processes in the namespace, and mapping network\ntraffic outside the namespace using native Layer-4 sockets.\n\nExisting approaches typically implement a full, generic TCP/IP stack for this\ntranslation between data and transport layers, without the possibility of\nspeeding up local connections, and usually requiring NAT. _pasta_:\n\n* avoids the need for a generic, full-fledged TCP/IP stack by coordinating TCP\n  connection dynamics between sender and receiver\n* offers a fast bypass path for local connections: if a process connects to\n  another process on the same host across namespaces, data is directly forwarded\n  using pairs of Layer-4 sockets\n* with default options, maps routing and addressing information to the\n  namespace, avoiding any need for NAT\n\n## Features\n\n✅: done/supported, ❌: out of scope, 🛠: in progress/being considered\n⌚: nice-to-have, eventually\n\n### Protocols\n* ✅ IPv4\n    * ✅ all features, except for\n    * ❌ fragmentation\n* ✅ IPv6\n    * ✅ all features, except for\n    * ❌ fragmentation\n    * ❌ jumbograms\n* ✅ [TCP](/passt/tree/tcp.c)\n    * ✅ Window Scaling (RFC 7323)\n    * ✅ Defenses against Sequence Number Attacks (RFC 6528)\n    * ⌚ [Protection Against Wrapped Sequences](https://bugs.passt.top/show_bug.cgi?id=1) (PAWS, RFC 7323)\n    * ⌚ [Timestamps](https://bugs.passt.top/show_bug.cgi?id=1) (RFC 7323)\n    * ❌ Selective Acknowledgment (RFC 2018)\n* ✅ [UDP](/passt/tree/udp.c)\n* ✅ ICMP/ICMPv6 Echo\n* ⌚ [IGMP/MLD](https://bugs.passt.top/show_bug.cgi?id=2) proxy\n* ⌚ [SCTP](https://bugs.passt.top/show_bug.cgi?id=3)\n\n### Portability\n* Linux\n    * ✅ starting from 4.18 kernel version\n    * ✅ starting from 3.13 kernel version\n* ✅ run-time selection of AVX2 build\n* C libraries:\n    * ✅ glibc\n    * ✅ [_musl_](https://bugs.passt.top/show_bug.cgi?id=4)\n    * ⌚ [_uClibc-ng_](https://bugs.passt.top/show_bug.cgi?id=5)\n* ⌚ [FreeBSD](https://bugs.passt.top/show_bug.cgi?id=6),\n  [Darwin](https://bugs.passt.top/show_bug.cgi?id=6)\n* ⌚ [NetBSD](https://bugs.passt.top/show_bug.cgi?id=7),\n  [OpenBSD](https://bugs.passt.top/show_bug.cgi?id=7)\n* ⌚ [Win2k](https://bugs.passt.top/show_bug.cgi?id=8)\n\n### Security\n* ✅ no dynamic memory allocation (`sbrk`(2), `brk`(2), `mmap`(2) [blocked via\n  `seccomp`](/passt/tree/seccomp.sh))\n* ✅ root operation not allowed outside user namespaces\n* ✅ all capabilities dropped, other than `CAP_NET_BIND_SERVICE` (if granted)\n* ✅ with default options, user, mount, IPC, UTS, PID namespaces are detached\n* ✅ no external dependencies (other than a standard C library)\n* ✅ restrictive seccomp profiles (33 syscalls allowed for _passt_, 43 for\n  _pasta_ on x86_64)\n* ✅ examples of [AppArmor](/passt/tree/contrib/apparmor) and\n  [SELinux](/passt/tree/contrib/selinux) profiles available\n* ✅ static checkers in continuous integration (clang-tidy, cppcheck)\n* ✅️ clearly defined boundary-checked packet abstraction\n* 🛠️ ~5 000 LoC target\n* ⌚ [fuzzing](https://bugs.passt.top/show_bug.cgi?id=9), _packetdrill_ tests\n* ⌚ stricter [synflood protection](https://bugs.passt.top/show_bug.cgi?id=10)\n* 💡 [add](https://lists.passt.top/) [your](https://bugs.passt.top/)\n  [ideas](https://chat.passt.top)\n\n### Configurability\n* ✅ all addresses, ports, port ranges\n* ✅ optional NAT, not required\n* ✅ all protocols\n* ✅ _pasta_: auto-detection of bound ports\n* ⌚ run-time configuration of port ranges without autodetection\n* ⌚ configuration of port ranges for autodetection\n* 💡 [add](https://lists.passt.top/) [your](https://bugs.passt.top/)\n  [ideas](https://chat.passt.top)\n\n### Performance\n* ✅ maximum two (cache hot) copies on every data path\n* ✅ _pasta_: zero-copy for local connections by design (no configuration\n  needed)\n* ✅ generalised coalescing and batching on every path for every supported\n  protocol\n* ✅ 4 to 50 times IPv4 TCP throughput of existing, conceptually similar\n  solutions depending on MTU (UDP and IPv6 hard to compare)\n* ✅ [_vhost-user_ support](https://bugs.passt.top/show_bug.cgi?id=25) for\n  maximum one copy on every data path and lower request-response latency\n* ⌚ [multithreading](https://bugs.passt.top/show_bug.cgi?id=13)\n* ⌚ [raw IP socket support](https://bugs.passt.top/show_bug.cgi?id=14) if\n  `CAP_NET_RAW` is granted\n* ⌚ eBPF support (might not improve performance over vhost-user)\n\n### Interfaces\n* ✅ native [qemu](https://bugs.passt.top/show_bug.cgi?id=11) support (_passt_)\n* ✅ native [libvirt](https://bugs.passt.top/show_bug.cgi?id=12) support\n  (_passt_)\n* ✅ Podman [integration](https://github.com/containers/podman/pull/16141)\n  (_pasta_)\n* ✅ bug-to-bug compatible\n  [_slirp4netns_ replacement](/passt/tree/slirp4netns.sh)\n* ✅ out-of-tree patch for\n  [Kata Containers](/passt/tree/contrib/kata-containers) available\n* ✅ rootless Docker\n  [network back-end](https://docs.docker.com/engine/security/rootless/#networking-errors)\n  via moby/rootlesskit\n\n### Availability\n* official packages for:\n    * ✅ [Alpine Linux](https://pkgs.alpinelinux.org/packages?name=passt)\n    * ✅ [Arch Linux](https://archlinux.org/packages/extra/x86_64/passt/) ([aarch64](https://archlinuxarm.org/packages/aarch64/passt), [i486](https://www.archlinux32.org/packages/?q=passt))\n    * ✅ [CentOS Stream](https://gitlab.com/redhat/centos-stream/rpms/passt)\n    * ✅ [Debian](https://tracker.debian.org/pkg/passt)\n    * ✅ [Fedora](https://src.fedoraproject.org/rpms/passt)\n    * ✅ [Gentoo](https://packages.gentoo.org/packages/net-misc/passt)\n    * ✅ [GNU Guix](https://packages.guix.gnu.org/packages/passt/)\n    * ✅ [OpenSUSE](https://build.opensuse.org/package/requests/Virtualization:containers/passt)\n    * ✅ [Ubuntu](https://launchpad.net/ubuntu/+source/passt)\n    * ✅ [Void Linux](https://voidlinux.org/packages/?q=passt)\n* unofficial packages for:\n    * ✅ [EPEL, Mageia](https://copr.fedorainfracloud.org/coprs/sbrivio/passt/)\n* ✅ unofficial [packages](https://passt.top/builds/latest/x86_64/) from x86_64\n  static builds for other RPM-based distributions\n* ✅ unofficial [packages](https://passt.top/builds/latest/x86_64/) from x86_64\n  static builds for other Debian-based distributions\n* ✅ testing on non-x86_64 architectures (aarch64, armv7l, i386, ppc64, ppc64le,\n  s390x)\n\n### Services\n* ✅ built-in [ARP proxy](/passt/tree/arp.c)\n* ✅ minimalistic [DHCP server](/passt/tree/dhcp.c)\n* ✅ minimalistic [NDP proxy](/passt/tree/ndp.c) with router advertisements and\n  SLAAC support\n* ✅ minimalistic [DHCPv6 server](/passt/tree/dhcpv6.c)\n* ⌚ fine-grained configurability of DHCP, NDP, DHCPv6 options\n\n## Interfaces and Environment\n\n_passt_ exchanges packets with _qemu_ via UNIX domain socket, using the `socket`\nback-end in qemu. This is supported since qemu 7.2.\n\nFor older versions, the [qrap](/passt/tree/qrap.c) wrapper can be used to\nconnect to a UNIX domain socket and to start qemu, which can now use the file\ndescriptor that's already opened.\n\nThis approach, compared to using a _tap_ device, doesn't require any security\ncapabilities, as we don't need to create any interface.\n\n_pasta_ runs out of the box with any recent (post-3.8) Linux kernel.\n\n## Services\n\n_passt_ and _pasta_ provide some minimalistic implementations of networking\nservices:\n\n* [ARP proxy](/passt/tree/arp.c), that resolves the address of\n  the host (which is used as gateway) to the original MAC address of the host\n* [DHCP server](/passt/tree/dhcp.c), a simple implementation\n  handing out one single IPv4 address to the guest or namespace, namely, the\n  same address as the first one configured for the upstream host interface, and\n  passing the nameservers configured on the host\n* [NDP proxy](/passt/tree/ndp.c), which can also assign prefix\n  and nameserver using SLAAC\n* [DHCPv6 server](/passt/tree/dhcpv6.c): a simple\n  implementation handing out one single IPv6 address to the guest or namespace,\n  namely, the same address as the first one configured for the upstream host\n  interface, and passing the nameservers configured on the host\n\n## Addresses\n\nFor IPv4, the guest or namespace is assigned, via DHCP, the same address as the\nupstream interface of the host, and the same default gateway as the default\ngateway of the host. Addresses are translated in case the guest is seen using a\ndifferent address from the assigned one.\n\nFor IPv6, the guest or namespace is assigned, via SLAAC, a prefix derived from\nthe address of the upstream interface of the host, the same default route as the\ndefault route of the host, and, if a DHCPv6 client is running in the guest or\nnamespace, also the same address as the upstream address of the host. This means\nthat, with a DHCPv6 client in the guest or namespace, addresses don't need to be\ntranslated. Should the client use a different address, the destination address\nis translated for packets going to the guest or to the namespace.\n\n### Local connections with _passt_\n\nFor UDP and TCP, for both IPv4 and IPv6, packets from the host addressed to a\nloopback address are forwarded to the guest with their source address changed to\nthe address of the gateway or first hop of the default route. This mapping is\nreversed on the other way.\n\n### Local connections with _pasta_\n\nPackets addressed to a loopback address in either namespace are directly\nforwarded to the corresponding (or configured) port in the other namespace.\nSimilarly as _passt_, packets from the non-init namespace addressed to the\ndefault gateway, which are therefore sent via the tap device, will have their\ndestination address translated to the loopback address.\n\n## Protocols\n\n_passt_ and _pasta_ support TCP, UDP and ICMP/ICMPv6 echo (requests and\nreplies). More details about the TCP implementation are described in the\n[theory of operation](/passt/tree/tcp.c), and similarly for\n[UDP](/passt/tree/udp.c).\n\nAn IGMP/MLD proxy is currently work in progress.\n\n## Ports\n\n### passt\n\nTo avoid the need for explicit port mapping configuration, _passt_ can bind to\nall unbound non-ephemeral (0-49152) TCP and UDP ports. Binding to low ports\n(0-1023) will fail without additional capabilities, and ports already bound\n(service proxies, etc.) will also not be used. Smaller subsets of ports, with\nport translations, are also configurable.\n\nUDP ephemeral ports are bound dynamically, as the guest uses them.\n\nIf all ports are forwarded, service proxies and other services running in the\ncontainer need to be started before _passt_ starts.\n\n### pasta\n\nWith default options, _pasta_ scans for bound ports on init and non-init\nnamespaces, and automatically forwards them from the other side. Port forwarding\nis fully configurable with command line options.\n\n## Stars 🌟\n[![Stars](https://starchart.cc/qemus/passt.svg?variant=adaptive)](https://starchart.cc/qemus/passt)\n\n[build_url]: https://github.com/qemus/passt/\n[release_url]: https://github.com/qemus/passt/releases/\n\n[Build]: https://github.com/qemus/passt/actions/workflows/build.yml/badge.svg\n[Size]: https://img.shields.io/badge/size-712_KB-steelblue?style=flat\u0026color=066da5\n[Version]: https://img.shields.io/github/v/tag/qemus/passt?label=version\u0026sort=semver\u0026color=066da5\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fqemus%2Fpasst","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fqemus%2Fpasst","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fqemus%2Fpasst/lists"}