Networking & DNS

A private per-tenant network with stable IPs and name resolution.

Every tenant gets an isolated virtual network. Your boxes share it, reach each other by name, and are firewalled off from other tenants — implemented as a per-tenant VRF over a VXLAN/VNI overlay (WireGuard underlay, BGP-EVPN control plane) inside a dedicated network namespace on each host.

Stable per-box IP

Each box gets an IP on your tenant subnet (e.g. 10.0.0.x) that's stable for the box's whole lifetime — including across suspend/resume and even live migration to another host. Cross-host box↔box traffic is transparently encapsulated over the overlay, so two of your boxes on different physical hosts talk as if on one LAN.

DNS

Boxes resolve each other by name within your tenant — an in-kernel eBPF DNS reflector on each host answers per-tenant queries, so ping mybox or curl http://api:8080 between your boxes just works, with no /etc/hosts juggling. Public DNS resolves normally for internet egress.

# from inside one box, reach another of yours by name
curl http://worker:8080/health
ssh anotherbox

Egress & wake-on-traffic

• Internet egress is NAT'd out per tenant — apt, curl, git work out of the box.
• Wake-on-traffic: a suspended box can be woken by an inbound packet (not just an SSH login). Declare which ports should wake it:

krillbox-guest wake-on --on tcp/8080 --on icmp   # wake on a hit to :8080 or a ping