Project

Every feature Ze ships.

52 shipped or experimental feature cards.

Each card's color is its category: how the feature fits into the system. Solid cards are shipped and dashed cards are experimental. Everything shipped runs in both daemon and appliance modes unless a card says otherwise. Click a category to filter, click again to show everything.

Built for demanding operators.

Ze starts with a configuration and protocol engine. The shipped network operating system adds BGP, interface management, FIB programming, plugins, operator tools, a minimal appliance runtime, and diagnostics as one product.

Services

Policy Routing

nftables PBR
  • L3/L4 match criteria
  • Table steering, next-hop actions
  • TCP-MSS clamping, interface wildcards

Experimental and growing.

Implemented, still waiting for production evidence or for a named part to be finished.

These still need deployment evidence, hardening, or a named part implemented or proven before production claims. The feature status page lists the status of each. Configuration may change.

Operate Experimental

Output Formatting

Shell-like pipes Offline
  • table, json, yaml, ndjson
  • match, count, first/last
  • Offline via ze pipe
  • Every command, no rendering flags
Operate Experimental

Web Workbench

HTMX SSE
  • YANG-driven config tree
  • Same CLI grammar in browser
  • Live updates via SSE
Operate Experimental

Looking Glass

Routes Topology Birdwatcher
  • Peer and route viewer
  • Topology graph
  • SSE streaming for live state
Observe Experimental

Development Activity

Heatmap Rebuilt each publish
  • A year of commits and added lines, at a glance
  • Built from git history each time
  • Current Go code composition
Observe Experimental

Tech-Support Bundle

Offline JSON
  • 20 modules, pure Go, no shell-outs
  • Structured JSON per module
  • Privacy-by-default, gokrazy-safe
Secure Experimental

Audit Trail

Commits Auth
  • Config commit, discard, and reload
  • Failed auth on every interface
  • Filter by action, actor, and time
Secure Experimental

PKI Store

X.509 TLS
  • YANG-modelled certificate management
  • Chain validation, expiry checks
  • Shared by IPsec, TLS, mutual auth
  • Local CA issues 24-hour certs to Ze's components
Services Experimental

IPsec VPN

IKEv2 X.509 EAP
  • Full IKEv2 engine, rekeying, DPD
  • NAT-T, keepalive, XFRM interfaces
  • EAP-MSCHAPv2, EAP-TLS, road warrior
  • CRL and OCSP revocation checks on EAP-TLS
Services Experimental

L2TPv2 BNG

PPP RADIUS CQM
  • RFC 2661 LNS and LAC with PPP
  • RADIUS auth, accounting, CoA
  • CQM monitoring, shaping, web UI
Services Experimental

PPPoE Access

RFC 2516 PPP
  • Access concentrator with discovery FSM
  • Shared PPP driver with L2TP
  • PAP, CHAP-MD5, and MS-CHAPv2 authentication
Services Experimental

Interface Management

Netlink DHCP
  • Ethernet, VLAN, bridge, WireGuard
  • 8 tunnel kinds, DHCP client
  • NTP sync, offload tuning, mirroring
  • IPv6 Router Advertisements, the radvd role
Services Experimental

Firewall

nftables NAT
  • 15 match types, 19 actions
  • SNAT, DNAT, masquerade
  • FlowSpec-to-firewall bridge
  • DNS-sourced address groups, TTL-tracked
Services Experimental

VPP Data Plane

DPDK GoVPP
  • FIB programming via GoVPP
  • MPLS label operations
  • Per-interface Prometheus metrics
Routing Experimental

MPLS / LDP / RSVP-TE

Labels Signaling
  • Kernel MPLS FIB, push/swap/pop
  • LDP discovery and sessions
  • RSVP-TE ERO, bandwidth admission
Routing Experimental

OSPFv2 / OSPFv3

RFC 2328 RFC 5340 ECMP
  • One ospf engine, IPv4 and IPv6 address families
  • SPF/ABR, NSSA, virtual links, NBMA/P2MP
  • Redistribution, SR, BFD, graceful restart
  • Interface cost priced from link speed
Routing Experimental

IS-IS

ISO 10589 Dual-stack
  • L1/L2 link-state IGP over Layer 2
  • RFC 5304/5310 authentication, key chains
  • Dual-stack IPv6, redistributes with BGP
Routing Experimental

VRRP

RFC 9568 RFC 3768 Virtual MAC
  • First-hop gateway redundancy, IPv4 and IPv6
  • Per-group virtual-MAC macvlan for L2 failover
  • keepalived interop, compile-out
  • Interface tracking, accept-mode
Observe Experimental

Flow Export

sFlow NetFlow IPFIX
  • sFlow v5, NetFlow v9, IPFIX
  • Packet sampling, conntrack flows
  • BGP next-hop enrichment
Secure Experimental

DDoS and Anomaly Detection

DDoS Anomaly FlowSpec
  • Volumetric and behavioral detection
  • Bounded incident history with durations
  • Local and upstream auto-mitigation
Platform Experimental

ISO and PXE Install

PXE ISO
  • PXE bare-metal provisioning
  • Current amd64 installation ISO under 150 MB
  • Local systemd install and uninstall
Platform Experimental

Kernel Tunables

Sysctl Profiles
  • Three-layer precedence
  • Named profiles (DSR, router, hardened)
  • Originals restored on stop
Services Experimental

AS112 Anycast DNS

AS112 Anycast
  • Authoritative sink zones on four fixed anycast addresses (RFC 7534/7535)
  • Conditional BGP origination via healthcheck-gated watchdog
  • Anycast IPs bound on lo automatically, never operator-typed
Routing Experimental

Segment Routing

SAFI 73 SRv6
  • SR-Policy NLRI (RFC 9830), SAFI 73
  • MPLS and SRv6 binding SID, tunnel encap
  • ExaBGP bridge for SR-Policy migration
Automate Experimental

Fleet Management

Managed config TLS hub
  • Per-client configuration and pinned hub certificate
  • Cached config with reconnect and heartbeat
  • Version hashing and two-phase fetch
Secure Experimental

IRR Route Filtering

IRR as-set
  • Prefix-lists from IRR data, live in the engine
  • Sourced from PeeringDB and RADB
  • Opt-in per peer, group or global filter chain
Automate Experimental

AI Tool Interfaces

MCP Generated AI tools
  • MCP exposes CLI/API commands
  • AI tools read structured output
  • Plugins expose discoverable tools
Operate Experimental

SSH CLI

Built-in SSH RBAC
  • Manage Ze without OS shell accounts
  • Profiles, audit, and accounting
  • commit, rollback, diff, completion
Operate Experimental

YANG Configuration

YANG ExaBGP
  • Schema-driven validation
  • One model feeds every surface
  • Plugin defined config and commands
Operate Experimental

System Readiness

ze doctor ze explain
  • Offline pre-start checks
  • Health, warnings, and errors
  • Structured remediation with ze explain
Routing Experimental

Native BGP Engine

BGP IPv4/IPv6 FlowSpec
  • Full implementation in Go
  • Lazy parsing, buffer-first encoding
  • Negotiated capabilities
Routing Experimental

Static Routes

ECMP BFD PBR
  • Named tables, policy routing
  • BFD-tracked failover
  • Multi-path ECMP groups
Routing Experimental

BFD

RFC 5880 Auth
  • Single-hop and multi-hop
  • GTSM, jitter, BGP integration
  • SHA1/MD5 auth, echo mode
  • Strict mode holds a BGP peer down until BFD is up
Routing Experimental

MRT Recording

RFC 6396 Analysis
  • Updates, messages, RIB snapshots
  • Strftime file rotation
  • Show, inject, replay, filter
Services Experimental

DNS Resolver

Cache Pipes
  • Built-in cached resolver
  • | resolve and | origin pipe operators
  • No external daemon needed
Automate Experimental

Plugin System

ExaBGP RPKI Policy
  • Plugins add commands, RPCs, events
  • YANG roots join CLI and web
  • Independent, composable
  • Each plugin declares what its failure means
Automate Experimental

Programmable

REST gRPC gNMI
  • REST API, gRPC, gNMI
  • Shared engine for identical output
  • Automate from any language
Automate Experimental

AI-First Design

Self-describing Skills
  • Self-describing command catalogue from the live binary
  • Every command is an automation surface
  • Structured diagnostics and repair plans
Automate Experimental

MCP Integration

MCP OAuth 2.1
  • Streamable HTTP transport, OAuth 2.1 resource server
  • Server-initiated elicitation, task-augmented tool calls
  • MCP Apps UI with embedded panels
Automate Experimental

ExaBGP Compatibility

Migration Bridge
  • Automatic config migration
  • Plugin bridge for existing workflows
  • Migration path for existing scripts
Observe Experimental

Evidence Over Claims

Fuzz Interop Docker
  • Unit, functional, fuzz, chaos
  • Performance benchmarks
  • Interop vs FRR, BIRD, GoBGP
Observe Experimental

Prometheus Telemetry

Netdata Prometheus
  • Prometheus metrics from /proc and /sys
  • Netdata metric names and labels
  • Built for existing Grafana dashboards
Observe Experimental

Health Registry

HTTP 503
  • /health HTTP endpoint
  • Per-component status checks
  • BGP, FIB, IPsec, L2TP, VPP
Observe Experimental

Host Inventory

CPU NIC SMART
  • CPU, NIC, DMI, memory, thermal
  • SMART disk health and self-tests
  • JSON output for pipelines
Observe Experimental

Crash Capture

Panic Syslog
  • Automatic panic stack traces
  • Ring buffer context (last 64 entries)
  • show crashes CLI command
Observe Experimental

Production Diagnostics

CLI MCP
  • Built-in tools replacing ss, dmesg, lsof
  • tcpdump, traceroute, ping, mtr
  • All exposed via MCP for AI debugging
Secure Experimental

Secure by Default

SSH RBAC RPKI ASPA
  • SSH access to the CLI
  • RPKI route origin validation
  • No other daemons needed
Secure Experimental

TACACS+ AAA

RFC 8907 Accounting
  • SSH login via TACACS+
  • Command accounting START/STOP
  • Server failover, local fallback
Platform Experimental

Minimal Appliance Mode

Appliance Server
  • Kernel, init, Ze runtime
  • No package manager or general shell
  • ISO/PXE bare-metal install
  • Linux server with systemd
Platform Experimental

Runs Itself

Update Systemd
  • Binary self-update
  • Built-in readiness checks
  • No orchestrator needed
Platform Experimental

Docker Support

Daemon only Scratch Compose
  • Static binary on scratch base
  • Compose support included
  • Optional build tags
Platform Experimental

Feature Gates

36 subsystems Default on
  • Compile out whole subsystems, BGP included
  • Smaller binary, smaller attack surface
  • Config fails closed on blocks the build lacks

Release roadmap

The release inventory lists remaining release work items and nice-to-haves from committed specs. It is an inventory preview pending owner classification.