Real network namespaces and real UDP/TCP traffic — not a user-space model of them.
KERNEL-LEVEL TESTING / LINUX ONLY
A test that crosses the gate has met the real kernel.
gateflow puts Rust test code inside an unprivileged Linux network namespace — with real sockets, real veth links, and real tc netem chaos.
Rust 1.88+
Linux namespaces
MIT / Apache-2.0
v0.1.0
EARLY DEVELOPMENT
Kernel behavior varies. If gateflow breaks on your distro or CI runner, file an issue or join #dev-tools on Discord.CYBERCORE · CYBERDECK · DIAGPRINT · GATEFLOW · CYBERMETA
sandbox trace / run_0142
PASSING
00.000✓fork()child is single-threaded
00.004✓unshareuser + network namespace
00.006✓uid_mapuid 1000 → uid 0 inside
00.011✓lo / netemdelay 100ms · loss 1%
00.013›test bodyreal UDP round trip
00.127✓exit 0gate cleared
namespace: 4026534217isolation: activehost root: not required
THE TEST BENCH FOR NETWORK-ADJACENT RUST
NO SIMULATION LAYER
01 / THE PREMISE
Models are useful.
Kernels are evidence.
Simulation gets you speed. gateflow gets you closer to the conditions your service actually has to survive: Linux namespaces, kernel sockets, link state, routing, and packet impairment enforced below your application.
Each sandbox gets its own network view, so tests can exercise failure without touching the host.
Delay, jitter, loss, reordering, corruption, and duplication through kernel netem.
02 / THE SURFACE
One API. Three
controlled worlds.
Start with a single isolated loopback. Add real chaos when timing matters. Move to a paired veth topology when two endpoints need to talk.
MODE 01
Fresh network namespace
A clean Linux network view with loopback brought up automatically. Perfect for testing bind behavior, local protocols, and isolation assumptions.
Sandbox::new().enter(|| {
your_test_body()
})
your_test_body()
})
HOST PROCESS
fork ↘
USER + NET NStest bodylo · 127.0.0.1
host root not required
03 / TOPOLOGY
When one namespace
isn't enough.
Sandbox::paired() builds a second namespace owned by the same user namespace, then wires both ends with a real veth pair. No host bridge. No fixed sleep. A handshake confirms both links are up before either closure runs.
2 namespaces1 veth pair0 host CAP_NET_ADMIN
pair / link-01LINK UP
namespace A10.200.100.1
veth-a ⇄ veth-b
namespace B10.200.100.2
UDP ROUND TRIP0.42 msCONFIRMED
04 / DEFENSE IN DEPTH
Resource limits.
Syscall boundaries.
Hardening is explicit. Add cgroup v2 memory, process, and CPU limits, then install a seccomp-BPF profile after network setup and before the test body runs.
cgroup v2
Memory ceilings, process-count limits, and CPU quotas under a delegated hierarchy.
OPT-IN / DELEGATED ROOTseccomp-BPF
Blocks namespace changes, mount operations, ptrace, BPF, reboot, and namespace-bearing clone calls.
OPT-IN / DEFENSE IN DEPTH05 / FIRST RUN
Put a gate
in your tests.
Install the published Rust crate for tests, or use the signed release installer for the diagnostic CLI. Both paths land on the same real kernel surface.
Read the quick start ↗ terminal / signed release
$
curl --proto '=https' --tlsv1.2 -fsSL https://github.com/cybercoretech/gateflow/raw/v0.1.0/scripts/install.sh | sh# Rust test dependency
cargo add gateflow --version 0.1.0 --features macros
# installer verifies Sigstore + SHA-256
requires: cosign, curl, tar, sha256sum
cargo add gateflow --version 0.1.0 --features macros
# installer verifies Sigstore + SHA-256
requires: cosign, curl, tar, sha256sum
THE TEST PASSED THE MODEL.
NOW RUN IT AGAINST THE KERNEL.