JIT WireGuard

Fly.io uses containers transformed into VMs with the help of Firecracker alchemy, running them worldwide. They extensively use WireGuard in their customer API. The company has made recent improvements to make WireGuard faster and more scalable for its users. One issue they faced was NATS not guaranteeing delivery, leading to unreliable gateways. Another problem was the accumulation of stale peer connections on the gateways, slowing down kernel operations. To solve these issues, Fly.io implemented a system where peers are only added to the kernel when clients want to connect and can be removed easily. This has led to faster connection setups and reduced state held by gateways.