NATless IPv6/IPv4 Address Translation
summary
Demonstrates a kernel‑level syscall interception that makes IPv6-only containers reach IPv4 services without per‑packet NAT by intercepting connect, switching into a separate IPv4 network namespace and performing an addfd swap to return the IPv4 socket to the original process. Uses a new seccomp() flag and Titus sidecar (TSA). Runs at Netflix across thousands of Titus agents, works in live demo, and relies on a kernel module workaround for an epoll/addfd bug until upstream fixes arrive.
AI-written summary · about
chapters (12)
- 0:00Introduction
- 2:31IPv6 adoption at Netflix
- 4:18Introducing Titus syscall agent
- 5:01Syscall interception in TSA
- 6:06TSA architecture and sequence
- 7:28TSA for IPv6 to IPv6
- 8:55Problem without TSA
- 9:17TSA for IPv6 to IPv4
- 11:06Live demo of TSA
- 15:21TSA efficiency
- 16:04Operational insights and plans
- 17:51Conclusion and Q&A
related talks
26mContainer Networking: The Play of BPF and Network NS with different...
31mHow to share IPv4 addresses by partitioning the port space
42mAccelerating Envoy with the Linux Kernel
20mNetKernel: Making Network Stack Part of the Virtualized Infrastructure
26mIPv6 First, Not Just Ready: Kubernetes Without IPv4 Using Cilium
27mLeveraging Cilium and SRv6 for Telco Networking
21mThe Way to Cloud Foundry with IPv4+IPv6 Dual Stack at SAP
35mLiberating Kubernetes From Kube-proxy and Iptables