Native data plane
Routing, upstream proxying, configuration and lifecycle stay in Go: fast to inspect, simple to deploy, easy to test.
GO COREGo-native infrastructure / Core-Wasm v0
Give your gateway
a sharper edge.
Dun is a self-contained Go data plane for routing, proxying and policy. Application-specific behavior runs in capability-scoped WebAssembly extensions instead of expanding the trusted core.
REQUEST PIPELINE LIVE MODEL
01ClientHTTP request
02Dun coreRoute · policy · proxy
03Wasm extensionScoped capability
04UpstreamService response
fresh instance per request reload without restart
The thesis
Keep the core understandable.
Move the edge out.
Gateways become difficult to reason about when every new policy becomes native code. Dun draws a hard line around the data plane and makes the extension boundary explicit.
That boundary is built for real operational questions: what can a plugin access, how much memory can it use, what happens when it fails, and how do we reload it without taking traffic down?
See the architectureArchitecture / v0
A narrow trusted path.
A deliberate boundary.
Capability-scoped Wasm
Extensions receive only the host imports granted by policy. Missing capabilities fail at instantiation instead of becoming implicit authority.
ISOLATED RUNTIMEFailure is a state
Traps, timeouts, cancellations and host-call failures are classified, recorded and contained. The core keeps serving.
OPERABLE BY DEFAULTA real local gateway
From clone to
first request.
Run the complete example: a Go backend, Dun on the edge, a security-header extension, route policy and Prometheus metrics.
Open the gateway example$ go run ./examples/gateway/backend
gateway backend listening on :3000
$ go run ./cmd/dun run -config examples/gateway/dun.yaml
plugin loaded · security-header · sha256 verified
$ curl -i localhost:8080/api/hello
HTTP/1.1 200 OK
X-Security-Policy: default-src 'self'
X-Frame-Options: DENY
{ "service": "gateway-backend" }
X-Security-Policy: default-src 'self'
X-Frame-Options: DENY
{ "service": "gateway-backend" }
v0Core-Wasm contract
1binary to deploy
48allocs / benchmark op
0CGO dependencies
Open by design
Make the boundary
better with us.
Dun is early, public and deliberately opinionated. Star the repository to follow the experiment, or bring a real gateway problem to the table.
Build the boundary