{"slug": "passt", "name": "passt", "category": "networking", "category_name": "Networking and VPN", "description": "", "recommenders": 3, "commenters": 3, "warners": 0, "score": 2.793, "rising": 1.67, "first": "2026-03-12", "latest": "2026-09-14", "why": "I always thought it's quite an interesting achievement.", "why_is_quote": true, "has_verdict": false, "sentiment": {"recommend": 3, "neutral": 0, "compare": 0, "warn": 0}, "spark": [0, 0, 0, 0, 1, 0, 0, 0, 0, 1, 1, 0], "listed": true, "loved": [], "caveat": "", "short_quote": "I always thought it's quite an interesting achievement.", "kind": "", "icon": true, "domain": "passt.top", "github_repo": null, "official_url": "https://passt.top", "pricing": "", "aliases": ["passt"], "verdict": null, "praise": [{"label": "", "summary": "", "quotes": [{"id": 795128784, "item_id": 49695549, "url": "https://news.ycombinator.com/item?id=49695549", "by": "exceptione", "date": "2026-09-14", "version": null, "stance": "recommend", "quote": "Unshare netns, then using pasta allows you to pass a user-space network adapter inside.", "excerpt": "Imho, the interface should not even be in the namespace to begin with. Unshare netns, then using pasta allows you to pass a user-space network adapter inside. https://passt.top/passt/about/ Caveat: I am no expert on Android.", "context": "", "use_case": "User-space networking in namespaces", "switched_from": "", "story": "Android NAT-T keepalive offload bypasses VPN lockdown"}, {"id": 794769472, "item_id": 49673092, "url": "https://news.ycombinator.com/item?id=49673092", "by": "exceptione", "date": "2026-09-12", "version": null, "stance": "recommend", "quote": "Would `pasta` be helpful to you?", "excerpt": "I am not sure why all your comments are flagged, but here is my response to your other comment: > We plan to heavily overhaul the VPN implementation to make most forms of leaks nearly impossible rather than continuing to use the current system prone to it. Thanks, great to hear. Given the slew of bugs you uncovered it seems the Android implementation has some rough edges. Would `pasta` be helpful to you? It allows yo", "context": "", "use_case": "User-space network namespace networking", "switched_from": "", "story": "Android NAT-T keepalive offload bypasses VPN lockdown"}, {"id": 791274658, "item_id": 49454666, "url": "https://news.ycombinator.com/item?id=49454666", "by": "bonzini", "date": "2026-08-26", "version": null, "stance": "recommend", "quote": "user mode networking these days should use passt", "excerpt": "QEMU has a secure subset, and the kitchen sink around it. For a properly configured VM, even better if wrapped in SELinux, it is not easy to escape even QEMU. In this case, of the four bugs it found: * Two were in libslirp, which is not part of that subset; user mode networking these days should use passt (https://passt.top/), an insanely cool hack that does user mode networking at many Gb/s and is secure * One (whic", "context": "", "use_case": "user-mode VM networking", "switched_from": "", "story": "VMs won't contain cyber-capable agents"}, {"id": 757713088, "item_id": 47357068, "url": "https://news.ycombinator.com/item?id=47357068", "by": "rwmj", "date": "2026-03-12", "version": null, "stance": "recommend", "quote": "I always thought it's quite an interesting achievement.", "excerpt": "passt (the network stack that you might be using if you're running qemu, or podman containers) also has no dynamic memory allocations. I always thought it's quite an interesting achievement. https://blog.vmsplice.net/2021/10/a-new-approach-to-usermode-networking.html https://passt.top/passt/about/#security", "context": "", "use_case": "User-mode networking for VMs", "switched_from": "", "story": "WolfIP: Lightweight TCP/IP stack with no dynamic memory allocations"}]}], "caveats": [], "who": [], "tags": [], "use_cases": ["user-space networking in namespaces", "user-space network namespace networking", "user-mode vm networking", "user-mode networking for vms"], "compared": [], "makers": [{"id": 757795600, "item_id": 47362225, "url": "https://news.ycombinator.com/item?id=47362225", "by": "sbrivio", "date": "2026-03-13", "version": null, "stance": "recommend", "quote": "it's actually pretty fast", "excerpt": "passt has been doing something similar for years (see https://passt.top/kvm_forum_2022.pdf pages 17, 18) and it's actually pretty fast (https://passt.top/#performance_1), even though it's not as resource-constrained as WolfIP. We're finally adding multithreading (https://bugs.passt.top/show_bug.cgi?id=13) these days.", "context": "", "use_case": "VM networking, TCP/IP", "switched_from": "", "story": "WolfIP: Lightweight TCP/IP stack with no dynamic memory allocations"}], "threads": [{"url": "https://news.ycombinator.com/item?id=49665502", "title": "Android NAT-T keepalive offload bypasses VPN lockdown", "mentions": 2}, {"url": "https://news.ycombinator.com/item?id=47352385", "title": "WolfIP: Lightweight TCP/IP stack with no dynamic memory allocations", "mentions": 2}, {"url": "https://news.ycombinator.com/item?id=49450188", "title": "VMs won't contain cyber-capable agents", "mentions": 1}], "sentiment_by_month": {"2025-11": {}, "2025-12": {}, "2026-01": {}, "2026-02": {}, "2026-03": {"recommend": 1}, "2026-04": {}, "2026-05": {}, "2026-06": {}, "2026-07": {}, "2026-08": {"recommend": 1}, "2026-09": {"recommend": 1}, "2026-10": {}}, "versions": [], "version_unnamed": 0, "family_ref": null, "runs_on": null, "lines": [], "quotes": [{"id": 795128784, "item_id": 49695549, "url": "https://news.ycombinator.com/item?id=49695549", "by": "exceptione", "date": "2026-09-14", "version": null, "stance": "recommend", "quote": "Unshare netns, then using pasta allows you to pass a user-space network adapter inside.", "excerpt": "Imho, the interface should not even be in the namespace to begin with. Unshare netns, then using pasta allows you to pass a user-space network adapter inside. https://passt.top/passt/about/ Caveat: I am no expert on Android.", "context": "", "use_case": "User-space networking in namespaces", "switched_from": "", "story": "Android NAT-T keepalive offload bypasses VPN lockdown"}, {"id": 794769472, "item_id": 49673092, "url": "https://news.ycombinator.com/item?id=49673092", "by": "exceptione", "date": "2026-09-12", "version": null, "stance": "recommend", "quote": "Would `pasta` be helpful to you?", "excerpt": "I am not sure why all your comments are flagged, but here is my response to your other comment: > We plan to heavily overhaul the VPN implementation to make most forms of leaks nearly impossible rather than continuing to use the current system prone to it. Thanks, great to hear. Given the slew of bugs you uncovered it seems the Android implementation has some rough edges. Would `pasta` be helpful to you? It allows yo", "context": "", "use_case": "User-space network namespace networking", "switched_from": "", "story": "Android NAT-T keepalive offload bypasses VPN lockdown"}, {"id": 791274658, "item_id": 49454666, "url": "https://news.ycombinator.com/item?id=49454666", "by": "bonzini", "date": "2026-08-26", "version": null, "stance": "recommend", "quote": "user mode networking these days should use passt", "excerpt": "QEMU has a secure subset, and the kitchen sink around it. For a properly configured VM, even better if wrapped in SELinux, it is not easy to escape even QEMU. In this case, of the four bugs it found: * Two were in libslirp, which is not part of that subset; user mode networking these days should use passt (https://passt.top/), an insanely cool hack that does user mode networking at many Gb/s and is secure * One (whic", "context": "", "use_case": "user-mode VM networking", "switched_from": "", "story": "VMs won't contain cyber-capable agents"}, {"id": 757713088, "item_id": 47357068, "url": "https://news.ycombinator.com/item?id=47357068", "by": "rwmj", "date": "2026-03-12", "version": null, "stance": "recommend", "quote": "I always thought it's quite an interesting achievement.", "excerpt": "passt (the network stack that you might be using if you're running qemu, or podman containers) also has no dynamic memory allocations. I always thought it's quite an interesting achievement. https://blog.vmsplice.net/2021/10/a-new-approach-to-usermode-networking.html https://passt.top/passt/about/#security", "context": "", "use_case": "User-mode networking for VMs", "switched_from": "", "story": "WolfIP: Lightweight TCP/IP stack with no dynamic memory allocations"}]}