nv Zero-Root, Air-Gapped Zero Trust Network

Core Architecture & Pillars

Traditional overlay networks demand kernel access and trust centralized orchestrators. nv inverts this trust model by executing entirely in user space with cryptographically certified permission boundaries.

🛡️

True Userspace Execution

No kernel module tampering or sudo required. Deploys natively in locked-down environments like non-privileged Docker containers, restricted CI runners, and multi-tenant nodes.

🔑

Ed25519-Stamped Certificates

Access requires stamped cryptographic certificates. Even if an orchestration server is compromised, unauthorized nodes cannot join without a valid, cryptographically signed stamp.

🧱

Air-Gap Ready by Default

Engineered for sovereign clouds, defense, and high-compliance data centers that cannot transmit telemetry or establish outbound sessions with third-party vendor clouds.

🎯

Strict Port Whitelisting

Eliminates broad subnet exposure. Network admins define explicit, port-level boundaries; unconfigured ports are completely invisible and blocked at the wire level.

⚡

On-Demand Instant Revocation

Revoke or grant access at will with immediate propagation. Admins retain full visibility and deterministic control over every active link on the mesh.

📦

Zero Container Blast Radius

Unlike competitors that require --privileged or /dev/net/tun mounts inside containers, nv functions as an unprivileged, isolated sidecar.

How nv Outperforms the Competition

Solutions like Tailscale and ZeroTier brought mesh VPNs to the mainstream, but their architecture compromises security posture in hardened enterprise setups.

✕ Competitor Vulnerabilities (Tailscale, ZeroTier)

Requires root / kernel privileges: Running daemons with root authority presents a major security vector and fails enterprise compliance on restricted boxes.

Cloud coordinator compromise risk: Rely on centralized coordination; a breach on their platform can expose access routes across customer networks.

Cannot run in unprivileged containers: Demands host device mounts (/dev/net/tun) and elevated Docker permissions, breaking container sandbox guarantees.

Broad subnet lateral movement: Default CIDR routing frequently exposes open ports and services unintentionally across the mesh.

Vendor cloud dependency: Difficult or impossible to deploy inside fully disconnected, sovereign air-gapped perimeters.

✓ The nv Advantage

100% userspace runtime: Executes cleanly as an unprivileged binary without ever requesting root or host elevation.

Cryptographically stamped verification: Ed25519 stamps verify node authenticity peer-to-peer, neutralizing upstream control plane spoofing.

Native unprivileged Docker support: Drop nv into any container image or Kubernetes pod with standard security profiles intact.

Strict port micro-segmentation: Operates strictly on configured ports. Attackers cannot probe or pivot to unlisted adjacent ports.

True offline / air-gap capability: Complete mesh self-sufficiency with zero third-party telemetry or cloud coordination dependencies.

Technical Protocol & Security Flow

An architectural breakdown of how nv establishes, secures, and maintains user-space connections across zero-trust nodes.

Lifecycle Stage	Protocol Action	Security Guarantee
1. Identity Stamping	Admin issues Ed25519 stamped token	Cryptographically binds user identity, target nodes, and permitted ports with signature authority.
2. Userspace Boot	Spawn non-root binary	Zero kernel modification; runs cleanly in locked server racks, CI runners, and Docker containers.
3. Peer Verification	Peer-to-peer certificate handshake	Bilateral cryptographic validation rejects unverified or spoofed incoming connection attempts.
4. Port Enforcement	Port-bounded tunnel initialization	Strict whitelist routing drops any packets traversing non-configured ports at the source.
5. Air-Gap Mode	Local discovery & private relay	Zero phone-home calls or external cloud dependencies required for node routing.
6. Access Revocation	Deterministic admin invalidation	Target peer stamp is instantly blacklisted mesh-wide without requiring node restarts.

Market Traction & Launch Path

The core networking engine is already proven. We are now completing the mobile client to bring the product to market.

Functional Working Prototype

The core userspace protocol and zero-root routing engine are fully tested and operational across unprivileged container workloads.

Tailscale-Scale Addressable Market

Tapping into the multi-billion-dollar enterprise Zero Trust market, specifically capturing industries where root access is banned and air-gaps are required.

Recruiting Mobile Specialist

Currently onboarding an experienced mobile systems engineer to build the native client interfaces across iOS and Android.

2 Months to MVP Launch

A focused sprint from working prototype to production MVP, ready for pilots with security-conscious engineering teams.

Targeted Enterprise Verticals

Ideal for air-gapped environments, defense contractors, fintech institutions, and locked-down Kubernetes clusters.

Granular Admin Central Control

Empowers network administrators with fine-grained policy control to grant, inspect, and revoke port access at will.

True Zero Trust means your network overlay shouldn't demand root control over your entire system to work. Security starts by removing root from the equation.

nv Engineering Philosophy