Requirements

Gateway

honk runs on Linux as root. It loads eBPF programs, creates the dae0 link and the daens namespace, and changes sysctls, so keep a second way into the machine, such as a console, during the first start.

• Linux 6.12 or later. honk rejects an older kernel before it attaches anything.
• The kernel options below. Desktop and server distributions usually enable them; OpenWrt, Armbian and VyOS need checking.
• cgroup v2 for pname(...) rules. Without it honk starts, and process-name routing stays off.
• bpffs mounted at /sys/fs/bpf.
• CA certificates, such as the ca-certificates package. Without them honk stops with “subscription network startup failed”.
• Geodata updates can raise memory use on small routers. honk streams them to disk; on OpenWrt with a mimalloc build, keep MIMALLOC_PURGE_DELAY=0 in the procd service to return freed memory promptly.

uname -r
zcat /proc/config.gz 2>/dev/null || cat /boot/config-$(uname -r)

CONFIG_BPF=y
CONFIG_BPF_SYSCALL=y
CONFIG_BPF_JIT=y
CONFIG_DEBUG_INFO_BTF=y
CONFIG_CGROUP_BPF=y
CONFIG_NET_CLS_BPF=y|m
CONFIG_NET_SCH_INGRESS=y|m
CONFIG_NET_CLS_ACT=y
CONFIG_NET_NS=y
# Held-first-packet UDP (NFQUEUE, on by default) also needs:
CONFIG_NF_TABLES=y|m
CONFIG_NF_TABLES_INET=y|m
CONFIG_NFT_CT=y|m
CONFIG_NETFILTER_NETLINK_QUEUE=y|m
CONFIG_NFT_QUEUE=y|m

Mount bpffs if the system does not:

sudo install -d -m 0755 /sys/fs/bpf
mountpoint -q /sys/fs/bpf || sudo mount -t bpf bpf /sys/fs/bpf
mountpoint /sys/fs/bpf
# To mount it at boot, add this line to /etc/fstab:
# bpf /sys/fs/bpf bpf defaults 0 0

honk version

• The honk-core assets for doona beta.19 come from Glassyiris/honk feat/native-api tag debug.2026.10.9.native-api.2, commit eac5e0c5fba5078a7ff4517a3e3851e7fa0f4f8e. They include the opt-in native-api build feature and embed doona 0.1.0-beta.19. HONK-SOURCE.txt records the tag and full honk commit and links both honk source and matching doona source. With ui: embedded, no standalone UI package is needed; an external ui directory remains an option.
• Builds of daeuniverse/honk main have no native API. honk rejects every native_api setting as unknown experimental setting, and /api and /ui/ answer 404.
• A build from feat/native-api without the native-api feature stops startup with native-api feature is required when native_api is enabled.
• Early feat/native-api builds update geodata but have no configurable sources. The builds attached to doona beta.8 and beta.9 have both.

Run honk-core --version to check the installed binary. To check the running version, use the Engine card on System status or the bottom of the side navigation.

Browser and build