Erebus: VPN client that runs without root privileges in user space.

What it does

Erebus is a VPN client that runs entirely in user space without requiring root privileges or kernel modifications. It exposes VPN connectivity through a local HTTP proxy. Applications point their traffic at this proxy to cross the VPN tunnel, while all other host networking remains unchanged. The tool supports OpenVPN with static keys, and can forward inbound traffic to expose local services back to VPN peers.

Who it is for

Erebus targets users and developers who need VPN access in restricted environments where traditional VPN clients cannot operate. This includes container deployments, CI/CD runners, sandboxed systems, and other locked-down hosts that do not permit root access or kernel module loading. It also suits users who want granular control over which applications use VPN, rather than tunneling all machine traffic.

Pricing

The site does not show prices.

How it stands out

Most VPN clients assume full control of the host operating system. They create kernel interfaces (TUN/TAP), rewrite system routing tables, and require root or administrator privileges. Erebus inverts this model. It performs all VPN operations—encryption, TCP/IP stacks, packet handling—inside a single user-space process. The approach leaves the host networking untouched and requires no system cleanup after use. Traffic routing is explicit and per-connection: only clients explicitly configured to use the local proxy cross the VPN. This per-application granularity differs from traditional VPN mode, where all host traffic routes through the tunnel by default.

What a founder should check

A competitor should verify whether traditional VPN vendors address the rootless use case. Major VPN clients focus on consumer and enterprise markets where kernel access is available; few optimize for containerized or sandboxed deployment. Investigate how much friction exists when running mainstream clients in CI/CD or container environments, and whether enterprises tolerate workarounds or actively seek alternatives. Second, examine switching costs: users in restricted environments may have few choices and thus minimal switching friction. Third, understand the technical moat. Erebus relies on a custom user-space TCP/IP stack. Evaluate whether this implementation matches the performance, reliability, and protocol support of kernel-based solutions, and whether replicating this stack is a meaningful engineering barrier or straightforward engineering work.

Thinking of building something like this?

Every launch here is a competitor to somebody's idea. If yours is close, check it against the market before you build: the Full Check names the rivals, the prices and the gaps.