Zostera: WireGuard as a MirageOS unikernel
2026-07-01Wireguard is a protocol that has successfully established itself as a competitor to OpenVPN. As such, and based on our experience with MirageVPN, we'd like to propose a unikernel implementing this protocol in OCaml.
Our main aim is to implement a WireGuard client, installable on all Linux and BSD systems, which, instead of encrypting/decrypting information in user space as all WireGuard clients do, will deploy a unikernel that will take care of this task.
From the user's point of view, this will be a simple WireGuard client, but from a security point of view, since we'll be using a unikernel, it and/or the host system won't be able to compromise each other, as they'll exist in two different physical memory spaces.
Drawing on our experience with MirageVPN, this client would be a “QubesOS-style” proposition for all users of Linux and BSD systems. The aim is to make this client available on distributions (Debian, Ubuntu, Archlinux, Fedora, etc.).
We would like to extend this work to the implementation of a server as a unikernel and propose a QubesOS client. The implementation of this protocol will also benefit the OCaml community and be reusable outside the unikernel context.
We received in 2026 funding through NGI0 Commons Fund, a fund established by NLnet with financial support from the European Commission's Next Generation Internet program. The amount is 50_000€.
Involved is Romain.