Zero-Root Overlay Architecture
How local unprivileged Docker containers bind into the nv userspace daemon and establish
encrypted tunnels to remote targets without opening firewall ports.
Non-root Docker containers route loopback traffic directly into the unprivileged nv
userspace binary.
Enterprises mint short-lived Ed25519 certificates via their private sovereign CA, validating peer identity bilaterally without external key escrow.
The remote machine dials outbound to rendezvous with the client, ensuring zero exposed inbound firewall ports.
Who Can Use This Tech
From multi-tenant corporate infrastructure to private developer home-labs high-assurance connectivity built for modern perimeters.
Empower Remote Teams with Zero-Trust Access
Grant distributed employees seamless, deterministic access to internal company resources, staging environments, and production services without legacy VPN concentrators.
- Least-Privilege by Default: Bind access strictly to required ports, neutralizing lateral movement risks.
- No Kernel Risk on BYOD: Safe to deploy on contractor and employee laptops without requesting root permissions.
- Instant Deprovisioning: Revoke cryptographic stamps globally in real-time when offboarding.
Secure Personal & Professional Digital Services
Effortlessly connect your laptop, mobile workstation, self-hosted Docker applications, and cloud VPS into one private, omnipresent network.
- Zero Port Forwarding: Access home NAS, media boxes, and dev instances without exposing public router ports.
- Remote Dev Environments: SSH directly into remote Docker sandboxes from local IDEs securely from coffee shops or planes.
- Complete Data Privacy: Air-gap capable with zero telemetry sent to third-party vendor clouds.
Convert Disparate Services into a Unified Mesh
Unify fragmented multi-cloud nodes, edge appliances, isolated VPCs, and bare-metal servers into a cohesive, addressable mesh network.
- Eliminate CIDR Overlaps: Overcome complex subnet collisions across multi-cloud environments.
- No Firewall Headaches: Traverses symmetric NATs and firewalls via outbound-only connections.
- Micro-Segmented Topology: Whitelist service-to-service communication paths with Ed25519-signed rules.
Indian Telecoms & 5G Core Infrastructure
Purpose-engineered for Indian telcos (Jio, Airtel, Vi, BSNL) and 5G Open-RAN rollouts requiring rigorous DoT compliance, CERT-In directives, and zero kernel tampering.
- Zero-Root Cell Tower Edge: Deploy telemetry and O&M sidecars across thousands of base transceiver stations (BTS) without root access or vendor kernel patching.
- DoT & CERT-In Sovereignty: In-country enterprise CA guarantees cryptographic stamps and logs remain strictly within Indian borders with zero third-party telemetry.
- 5G Core Micro-Segmentation: Securely interconnect User Plane Functions (UPF), O-RAN edge pods, and air-gapped OSS/BSS with strict port-bounded isolation.
Core Architecture & Pillars
Traditional overlay networks demand kernel access and trust centralized orchestrators. nv inverts
this trust model by executing entirely in user space with cryptographically certified permission boundaries.
True Userspace Execution
No kernel module tampering or sudo required. Deploys natively in locked-down environments like
non-privileged Docker containers, restricted CI runners, and multi-tenant nodes.
Sovereign Enterprise CA
Enterprises deploy their own dedicated Certificate Authority (CA) to mint and stamp Ed25519 certificates on-premise. No third-party key escrow, vendor cloud dependency, or external master authority.
Air-Gap Ready by Default
Engineered for sovereign clouds, defense, and high-compliance data centers that cannot transmit telemetry or establish outbound sessions with third-party vendor clouds.
Strict Port Whitelisting
Eliminates broad subnet exposure. Network admins define explicit, port-level boundaries; unconfigured ports are completely invisible and blocked at the wire level.
On-Demand Instant Revocation
Revoke or grant access at will with immediate propagation. Admins retain full visibility and deterministic control over every active link on the mesh.
Zero Container Blast Radius
Unlike competitors that require --privileged or /dev/net/tun mounts inside
containers, nv functions as an unprivileged, isolated sidecar.
How nv Outperforms the Competition
Solutions like Tailscale and ZeroTier brought mesh VPNs to the mainstream, but their architecture compromises security posture in hardened enterprise setups.
✕ Competitor Vulnerabilities (Tailscale, ZeroTier)
/dev/net/tun) and elevated Docker permissions, breaking container
sandbox guarantees.
✓ The nv Advantage
nv into any container image or Kubernetes pod with standard security profiles intact.
Technical Protocol & Security Flow
An architectural breakdown of how nv establishes, secures, and maintains user-space connections
across zero-trust nodes.
| Lifecycle Stage | Protocol Action | Security Guarantee |
|---|---|---|
| 1. Enterprise CA Stamping | Enterprise CA mints Ed25519 stamp | Private enterprise CA issues signed stamps binding identity and ports; keys stay strictly in-house with zero external custody. |
| 2. Userspace Boot | Spawn non-root binary | Zero kernel modification; runs cleanly in locked server racks, CI runners, and Docker containers. |
| 3. Peer Verification | Peer-to-peer certificate handshake | Bilateral cryptographic validation rejects unverified or spoofed incoming connection attempts. |
| 4. Port Enforcement | Port-bounded tunnel initialization | Strict whitelist routing drops any packets traversing non-configured ports at the source. |
| 5. Air-Gap Mode | Local discovery & private relay | Zero phone-home calls or external cloud dependencies required for node routing. |
| 6. Access Revocation | Deterministic admin invalidation | Target peer stamp is instantly blacklisted mesh-wide without requiring node restarts. |
Market Traction & Launch Path
The core networking engine is already proven. We are now completing the mobile client to bring the product to market.
Functional Working Prototype
The core userspace protocol and zero-root routing engine are fully tested and operational across unprivileged container workloads.
Tailscale-Scale Addressable Market
Tapping into the multi-billion-dollar enterprise Zero Trust market, specifically capturing industries where root access is banned and air-gaps are required.
Recruiting Mobile Specialist
Currently onboarding an experienced mobile systems engineer to build the native client interfaces across iOS and Android.
3 Months to MVP Launch
A focused sprint from working prototype to production MVP, ready for pilots with security-conscious engineering teams.
Indian Telecoms & Regulated Verticals
Ideal for Indian 5G telco infrastructure (O-RAN, BTS edge, DoT/CERT-In compliance), defense contractors, fintech, and air-gapped operations.
Granular Admin Central Control
Empowers network administrators with fine-grained policy control to grant, inspect, and revoke port access at will.
True Zero Trust means your network overlay shouldn't demand root control over your entire system to work. Security starts by removing root from the equation.