grpc-transports

Custom gRPC transports in pure Go — tunnel gRPC over a WireGuard overlay, an SSH connection, the host↔guest AF_VSOCK family, or a WebSocket (full bidi gRPC in the browser via js/wasm). Each transport hands you a net.Listener for grpc.Server and a matching client dialer.

net.Listener + client dialer inter-VM RPC WireGuard overlay SSH tunnel AF_VSOCK host↔guest WebSocket / wasm no sidecar proxy
wireguard GitHub

Four transports, one shape. Each repo is a Go library that adapts standard google.golang.org/grpc to a different carrier: the server exposes a net.Listener you pass straight to grpc.Server.Serve, and the client provides a dialer that routes every channel through the same tunnel. No protobuf changes, no service-mesh sidecar — the transport is the only moving part you swap.

Pick the carrier that matches the trust model. wireguard targets inter-VM RPC across hosts and zones — a WireGuard overlay with a privilege-free userspace backend (wireguard-go + gVisor netstack) and a line-rate Linux kernel backend brought up through pure-Go netlink, no iproute2 in the rootfs. ssh targets human-driven clients, reusing Ed25519 host keys and SSH agent forwarding for authentication. vsock targets host↔guest RPC on one machine — the AF_VSOCK address family used by KVM/QEMU and Apple VZ, addressed by (context id, port) with no IP stack in the guest. websocket targets the browser — the client compiles to js/wasm and speaks full gRPC, including client-streaming and bidirectional streaming, over a WebSocket with no grpc-web sidecar.

Repositories

wireguard libwireguard

gRPC over a WireGuard overlay (net.Listener + grpc.DialOption)

userspace (wireguard-go + gVisor netstack) or kernel WireGuard

Tunnels gRPC between VMs over a WireGuard overlay regardless of host. Two backends ship side by side: a default userspace data path (wireguard-go + gVisor netstack, no privileges, any OS) and a Linux kernel-WireGuard backend (CAP_NET_ADMIN, line-rate) brought up via pure-Go netlink + wgctrl — no iproute2 or wireguard-tools in the rootfs.

ssh libssh

gRPC over an SSH tunnel (net.Listener + grpc.DialOption)

Ed25519 host keys + SSH agent forwarding

Wraps inbound SSH connections as gRPC-ready net.Conn for a standard grpc.Server, and dials gRPC channels over SSH from the client. Ed25519 host-key auto-generation and SSH agent forwarding for client auth. Suited to human-driven CLI clients where SSH's per-user key model fits.

vsock libvsock

gRPC over AF_VSOCK (net.Conn Dialer + net.Listener)

Linux virtio-vsock (KVM/QEMU or Apple VZ); amd64 · arm64 · riscv64 · loong64 · ppc64le · s390x

Host↔guest gRPC over the AF_VSOCK address family, addressed by (context id, port) with no IP stack in the guest. Listen returns a net.Listener whose connections report the peer CID; Dialer.DialContext matches grpc.WithContextDialer. Dependency-free pure Go (CGO=0); the syscall layer is seamed for 100% coverage, error branches included, on all six 64-bit arches. Linux-only, with a portable non-Linux stub so cross-platform callers still build.

websocket libwebsocket

gRPC over a WebSocket — the carrier that works inside the browser (net.Listener + grpc.DialOption)

native (coder/websocket) + js/wasm (syscall/js, zero deps); amd64 · arm64 · riscv64 · loong64 · ppc64le · s390x

Tunnels gRPC over a WebSocket, so the same client compiles and runs under GOOS=js/GOARCH=wasm and speaks full gRPC in the browser — including client-streaming and bidirectional streaming — with no Envoy/grpc-web sidecar. grpc-go runs its HTTP/2 framing in userspace over a net.Conn wrapping the WebSocket; the server is a plain grpc.Server behind net.Listener. Two client backends behind one signature (coder/websocket native, syscall/js on wasm). 100% native coverage plus a Node-driven js/wasm end-to-end test.

Each transport is a small Go library over standard google.golang.org/grpc — a net.Listener on the server side and a grpc.DialOption on the client side, so existing gRPC services move across without touching their protobuf or handlers. BSD-3-Clause throughout.