TNG

KO | EN

gitlite — search

#javascript #hacktoberfest #react #go #android #linux #java #cli #awesome-list #pytorch #security #mcp #openai #open-source

(★ 22)

Trusted Network Gateway: A tool for establishing secure communication tunnels in confidential computing.

TNG 최신버젼 다운로드

최종 버전 다운로드 (.zip)

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

# TNG

[![Build Docker](https://raw.githubusercontent.com/inclavare-containers/actions/workflows/build-docker.yml/badge.svg)](/../../actions/workflows/build-docker.yml)
[![Build RPM](https://raw.githubusercontent.com/inclavare-containers/actions/workflows/build-rpm.yml/badge.svg)](/../../actions/workflows/build-rpm.yml)
[![Build Python SDK](https://raw.githubusercontent.com/inclavare-containers/actions/workflows/build-python-sdk.yml/badge.svg)](/../../actions/workflows/build-python-sdk.yml)
[![Build WASM SDK](https://raw.githubusercontent.com/inclavare-containers/actions/workflows/build-wasm-sdk.yml/badge.svg)](/../../actions/workflows/build-wasm-sdk.yml)
[![CI](https://raw.githubusercontent.com/inclavare-containers/actions/workflows/test.yml/badge.svg)](/../../actions/workflows/test.yml)
[![codecov](https://codecov.io/gh/inclavare-containers/TNG/graph/badge.svg?token=7CUZW26SH6)](https://codecov.io/gh/inclavare-containers/TNG)
[![npm](https://img.shields.io/npm/v/@inclavare-containers/tng?logo=npm&label=npm)](https://www.npmjs.com/package/@inclavare-containers/tng)
[![PyPI](https://img.shields.io/pypi/v/tng-sdk?logo=pypi&label=pypi)](https://pypi.org/project/tng-sdk/)
[![Go Reference](https://pkg.go.dev/badge/github.com/inclavare-containers/tng/tng-go.svg)](https://pkg.go.dev/github.com/inclavare-containers/tng/tng-go)
[![License](https://img.shields.io/badge/License-Apache%202.0-blue.svg)](https://opensource.org/licenses/Apache-2.0)
[![Rust](https://img.shields.io/badge/rustc-1.89.0+-blue?logo=rust)](https://www.rust-lang.org)

[中文文档](README_zh.md)

> **Trusted Network Gateway** — a transparent gateway that establishes **end-to-end encrypted tunnels with remote attestation** for confidential computing environments. Zero code changes required.

## Quick Start

TNG offers multiple integration modes — pick the one that fits your scenario.

<details>
<summary>Run with Docker — fastest way to try TNG</summary>

```sh
docker run -it --rm --privileged --network host --cgroupns=host \
 ghcr.io/inclavare-containers/tng:latest \
 tng launch --config-content='<your config json>'
```

No installation needed. Just provide a JSON config and TNG handles the rest.

</details>

<details>
<summary>tng exec — zero code changes for existing apps</summary>

```sh
# Start your existing app through TNG transparently
tng exec --config-file config.json -- ./your-app
```

Your app talks to the backend as usual — TNG intercepts at the network layer and encrypts via remote attestation tunnel.

</details>

<details>
<summary>JavaScript SDK — browser-side encrypted requests</summary>

```sh
npm install @inclavare-containers/tng
```

```js
import { TngClient } from '@inclavare-containers/tng';

const client = new TngClient({ config: { /* your config */ } });
const response = await client.fetch('https://your-tee-service/api/data');
```

Runs entirely in the browser via WebAssembly. No server-side proxy needed.

</details>

<details>
<summary>Python SDK — programmatic integration</summary>

```sh
pip install tng-sdk
```

```python
from tng import TngClient

client = TngClient(config={"ingress": {...}, "egress": {...}})
response = client.request("https://your-tee-service/api/data")
```

Supports `httpx`, `requests`, and `openai` as optional backends.

</details>

<details>
<summary>Go SDK — programmatic integration for Go services</summary>

```sh
go get github.com/inclavare-containers/tng/tng-go
```

```go
import "github.com/inclavare-containers/tng/tng-go"

// Spawns a TNG subprocess with an http_proxy ingress automatically
rt, err := tng.NewRoundTripper(&tng.Config{NoRA: true})
if err != nil {
    log.Fatal(err)
}
defer rt.Close()

// Works with the standard http.Client
client := &http.Client{Transport: rt}
resp, err := client.Get("http://your-tee-service/api/data")
```

Pure Go, no CGO required. Drop-in `http.RoundTripper` for any Go HTTP client.

</details>

See [Installation](#installation) for Docker, RPM, binary, and SDK options.

---

## Table of Contents

- [What is TNG?](#what-is-tng)
- [How It Works](#how-it-works)
- [Key Features](#key-features)
- [Why TNG vs. Other Solutions?](#why-tng-vs-other-solutions)
- [Installation](#installation)
- [Project Structure](#project-structure)
- [Documentation](#documentation)
- [Contributing](#contributing)
- [License](#license)

---

## What is TNG?

TNG (Trusted Network Gateway) is a transparent gateway tool that brings **remote attestation + encrypted tunnel** capability to confidential computing, based on the [IETF RFC 9334](https://datatracker.ietf.org/doc/rfc9334/) (RATS) standard.

It enables two parties to automatically verify each other's runtime environment — *"who you are and what code you're running"* — and establish an end-to-end encrypted channel, **without modifying any business code**.

```mermaid
graph LR
    subgraph ClientEnv [Client Environment]
        App[Application]
        TNG_In[TNG Ingress]
    end

subgraph TrustedEnv ["TEE (TDX / SEV-SNP / CSV)"]
        TNG_Eg[TNG Egress]
        Service[Business Service]
    end

App -- Plain Traffic --> TNG_In
    TNG_In -. Remote Attestation + Encrypted Tunnel .-> TNG_Eg
    TNG_Eg -- Decrypt & Forward --> Service

style TrustedEnv fill:#ffd700,stroke:#d4af37,stroke-width:2px
    linkStyle 1 stroke:#d4af37,stroke-width:2px
```

## How It Works

1. **Deploy** a pair of TNG instances — one as **Ingress** (tunnel entry, on the client side) and one as **Egress** (tunnel exit, on the server side in a TEE).

> **Naming note:** "Ingress" means traffic *entering the tunnel*, not "incoming to a server." Think of it as the tunnel's front door — the client-side endpoint where plaintext traffic gets encrypted and sent through the tunnel. Egress is the opposite end where traffic exits the tunnel and reaches the destination service.
2. **Remote Attestation** — the Ingress verifies the Egress's TEE hardware, software hashes, and runtime configuration via the [Attestation Agent (AA)](docs/architecture.md#remote-attestation) and Attestation Service (AS).
3. **Encrypted Tunnel** — once verified, an end-to-end encrypted tunnel is established (RA-TLS or OHTTP).
4. **Transparent Forwarding** — plaintext traffic from the client application is automatically encrypted, forwarded through the tunnel, and decrypted at the server side — all at the network layer.

The entire process is **driven by a single JSON config file**. No SDK integration, no code changes, no certificate management.

## Key Features

| | |
|---|---|
| 🔐 **Multiple Protocols** | RA-TLS for arbitrary TCP traffic, OHTTP for HTTP message-level encryption |
| 🚫 **Zero Intrusiveness** | Transparent proxy via netfilter, HTTP proxy, or Socks5 — no business code changes |
| 📦 **Flexible Deployment** | VM daemon, K8s Sidecar, browser SDK — one binary, many forms |
| 🔀 **Bidirectional RA** | Unidirectional, bidirectional, or reverse-RA — configurable per your trust model |
| 🦀 **Pure Rust** | Built-in RA-TLS implemented in Rust for memory safety |
| 🧩 **CoCo Ecosystem** | Works with [`guest-components`](https://github.com/confidential-containers/guest-components) & [`trustee`](https://github.com/confidential-containers/trustee) |

## Why TNG vs. Other Solutions?

| Aspect | Traditional TLS (PKI) | RA-TLS Libraries | Service Mesh (SPIFFE) | **TNG** |
|---|---|---|---|---|
| **Trust Root** | CA-issued X.509 certs | TEE hardware evidence | CA-issued SPIFFE certs | **TEE hardware evidence** |
| **Runtime Verification** | No | Manual integration required | No | **Built-in, fine-grained** |
| **Code Changes** | App must handle TLS | App must link RA-TLS lib | Infrastructure-level | **None** |
| **Cert Management** | Apply, distribute, rotate | Manual | Automated via mesh | **Not needed** |
| **Deployment** | Per-app config | Per-app integration | Full mesh infra | **Single JSON config** |
| **Protocol Support** | TLS only | TLS variant | TLS only | **RA-TLS + OHTTP** |

## Installation

### Option 1: Docker (Recommended)

```sh
docker run -it --rm --privileged --network host --cgroupns=host \
 ghcr.io/inclavare-containers/tng:latest \
 tng launch --config-content='<your config json>'
```

### Option 2: RPM Package

```sh
sudo rpm -ivh tng-<version>.rpm
sudo tng launch --config-file=/etc/tng/config.json
```

### Option 3: Binary

Download the pre-built binary from [Releases](https://github.com/inclavare-containers/TNG/releases) and run directly.

### Option 4: JavaScript SDK (Browser)

```sh
npm install @inclavare-containers/tng
```

Full SDK docs: [tng-wasm/README.md](tng-wasm/README.md)

### Option 5: Python SDK

```sh
pip install tng-sdk
```

Full SDK docs: [tng-python/README.md](tng-python/README.md)

### Option 6: Go SDK

```sh
go get github.com/inclavare-containers/tng/tng-go
```

Full SDK docs: [tng-go/README.md](tng-go/README.md)

> [!TIP]
> **New to TNG?** Start with [Core Concepts & Workflow](docs/architecture.md) to understand the Ingress/Egress model and remote attestation roles, then check the [Configuration Reference](docs/configuration.md) for all available fields.

## Project Structure

```
tng/             Core gateway binary (CLI) — the main entry point
rats-cert/       Certificate generation and management library
tng-hook/        LD_PRELOAD hook library (libtng_hook.so) for `tng exec` transparent port interception
tng-wasm/        WebAssembly module + JavaScript SDK for browsers
tng-python/      Python SDK for programmatic integration
tng-go/          Go SDK for programmatic integration
tng-testsuite/   Integration and e2e test cases
scripts/         Build, deploy, and CI helper scripts
docs/            Architecture, configuration, scenarios, and developer guides
```

## Documentation

| Document | Description |
|---|---|
| [Core Concepts & Workflow](docs/architecture.md) | Ingress/Egress model, RA roles (AA/AS), RATS-TLS & OHTTP protocols |
| [Configuration Reference](docs/configuration.md) | Complete field-by-field reference with examples |
| [Scenario Guides](docs/scenarios/) | Real-world deployment topologies with full configs |
| [Developer Guide](docs/developer.md) | Build from source (Docker/RPM), run tests, integrate |
| [Version Compatibility](docs/version_compatibility.md) | Breaking changes and migration notes between versions |
| [JavaScript SDK](tng-wasm/README.md) | Browser-side SDK usage and examples |
| [Python SDK](tng-python/README.md) | Python SDK usage and examples |
| [Go SDK](tng-go/README.md) | Go SDK usage and examples |

## Contributing

Contributions are welcome! Please feel free to submit an [Issue](https://github.com/inclavare-containers/TNG/issues) or [Pull Request](https://github.com/inclavare-containers/TNG/pulls).

Before pushing, ensure:

```bash
make clippy && cargo fmt --check && cargo build
```

See [Developer Guide](docs/developer.md) for detailed build and test instructions.

## License

[Apache-2.0](LICENSE)

TNG

TNG 최신버젼 다운로드

오늘의 추천 프로젝트

Was this content helpful?

Recent Feedback

TNG

TNG 최신버젼 다운로드

오늘의 추천 프로젝트

Was this content helpful?

Recent Feedback

Download README