pkg/

Package auth contains APIServer authentication helpers.

Package controllers implements Apoxy Control Plane-side controllers.

Package extensions implements extensions controllers.

Package gateway implements Gateway API controllers.

Package migration holds one-shot storage migrations run at apiserver startup.

Package policy implements API Server policy controllers.

Package secretstore implements the REST plumbing that makes SecretStore values write-only: a redacting wrapper that strips stored values from every main-resource response, a "values" subresource that is the single path through which values are written and (by internal identities only) read, and the authorizer gate that enforces the read restriction.

Package logs provides logging facilities for Envoy.

Package logtail consumes log files and manages compaction using fallocate.

Package metrics provides an HTTP handler for proxying metrics requests to specific upstream endpoints using net/http/httputil.ReverseProxy.

Package otel provides functionality for managing OpenTelemetry collector processes.

Package portforward watches a port on a ProxyReplica and forwards from a local port to the remote port on the ProxyReplica.

Package manifest implements Edge Function Manifest utilities.

Package reload provides hot-reloading of TLS keypairs that are rotated in place on disk (e.g.

Package migrations provides database migrations for ClickHouse.

Package vpc provides the `apoxy vpc` command tree for managing vpc.apoxy.dev objects: networks, services, relays, and tunnels.

Package commands holds the built-in diag commands.

Package protocol defines the wire format for the agent diag channel: nd-json frames over one long-lived HTTP/3 stream, demuxed by Id so multiple commands can interleave.

Package controller implements the edge function controller that manages per-namespace edge runtimes with multiple dynamically-loaded functions.

Package runc implements container runtime based on OpenContainers libcontainer package.

Package iptables container useful routines for manipulating iptables rules.

This file contains code derived from Contour, https://github.com/projectcontour/contour from the source file https://github.com/projectcontour/contour/blob/main/internal/xds/v3/snapshotter.go and is provided here subject to the following: Copyright Project Contour Authors SPDX-License-Identifier: Apache-2.0

Import all Envoy filter types so they are registered and deserialization does not fail when using them in the "typed_config" attributes.

Package apiregistration handles Apoxy API service registration with Kubernetes API Aggregation

Package vpcdns is the serving core of the Apoxy VPC name plane: a CoreDNS plugin that answers, authoritatively, for names bound into a project's VPC (tunnel endpoints today, VPC-bound Services later) and passes everything else to the next plugin in the chain (typically cache -> upstream).

The InitStr envelope is pure JSON with no gvisor dependencies — leave it without a //go:build constraint so cross-platform unit tests can exercise Encode/Decode without pulling in linux-only gvisor packages.

Package egressfwd installs the in-Sentry egress forwarders for compute-worker sandboxes — the APO-713 data path that makes a worker fetch() actually leave the box.

Package egresswire is the pure wire framing shared by the two ends of the compute egress data path: the in-Sentry forwarder (pkg/sandbox/sentrystack/ egressfwd) writes the preamble, and the host egress bridge (pkg/workerd/host) reads it.

Package agent implements the tunnel agent: the client side of the vpc.apoxy.dev relay stack.

Package bfdl implements a BFD-lite (RFC 5880 subset) protocol for application-level liveness detection between tunnel agents and the tunnelproxy server.

Package conntrack provides a lightweight TCP connection tracker that implements connection.PacketObserver.

Package conntrackpc provides a conntrack-style multiplexer for net.PacketConn, suitable for QUIC clients that want multiple "virtual" PacketConns over one UDP socket.

Package endpointselect provides endpoint selection strategies for tunnel connections.

Package fasttun implements a high-performance interface to Linux TUN devices with support for multi-queue and batched packet I/O.

Package ipalloc holds the relay-side, in-process connection address allocators for the vpc.apoxy.dev relay (APO-825 §2.8).

Package docker implements Docker utils.

Package build turns a JS/TS project into a staged compute service bundle: esbuild runs in-process (wrangler-style: ESM output, workerd conditions) with a module-collector plugin that turns wasm/text/data imports into separate bundle modules instead of inlining them.

Package bundle packs, pushes, and stages compute service bundles: the OCI artifact shape the workerd data plane pulls (pkg/workerd/host).

Package host drives stock workerd inside a gVisor/runsc sandbox via clrk's extracted pkg/sandbox.Runtime.

Package manager implements the APO-796 ServiceManager: the control-plane Service->ServiceRevision minting reconciler (platform-neutral, this file) and the data-plane resident reconciler (resident_reconciler.go) that drives the workerd resident and publishes this node's serveable routing.

Package names is the single owner of the workerd resident naming scheme.