WireGuard at Modal: Static IPs for serverless containers

This post details the implementation of Modal's Static IP Proxies, which leverage WireGuard for Layer 3 VPN tunnels to provide consistent IPv4 egress addresses for serverless containers. It describes the design of the Go-based _vprox_ proxy, including its HTTPS listener for connection setup, peer management using wgctrl and handshake times for idle peer removal, and client-side connection probing. The post also explains how policy-based routing and IP masquerading on worker machines ensure all container traffic is routed through the VPN, enabling static IP access for external services.