A lion at the edge

The itch

Enix operates and manages cloud and on-prem infrastructure for a living. On the edge of those platforms sits the least glamorous, most critical box: the one doing firewalling, routing and load-balancing. Too often it is a general-purpose Linux host pushing packets through the kernel, a pile of hand-written config, and an upgrade path that means a maintenance window and crossed fingers.

We wanted something else: an appliance that forwards at line rate, that you configure by declaring what you want, and that upgrades itself atomically without anyone logging in to poke at it.

The bet

Three decisions shaped SiHA:

• Kernel-bypass dataplane. Packets are handled by VPP over DPDK poll-mode drivers — never the Linux networking stack. Forwarding is fast and predictable.
• Immutable, self-upgrading OS. One signed image, booted under SecureBoot, upgraded via atomic A/B swaps that roll back on their own if health checks fail.
• Declarative control plane. No SSH, no config files. You apply resources; the control plane reconciles them into the dataplane and holds the line.

The name

SiHA means lion — the animal that guards its territory, watches the whole plain, and moves fast when it has to. It seemed about right for a box that sits at the gate and decides what gets through.