Zeroserve replaces nginx config files with sandboxed eBPF programs

Zeroserve is a single-binary HTTPS server that treats an entire website as a tarball and skips the config file entirely. The site loads in place — indexed by path-to-byte-range and served via io_uring through a single-threaded event loop — with hot reload triggered by SIGHUP. TLS 1.3, HTTP/2, Encrypted Client Hello, SNI cert selection, and JA4 fingerprinting are all built in, which is a notably broad transport-security surface for a zero-config binary.

The interesting design choice is using userspace eBPF as the configuration language. C files dropped into the tarball get compiled to eBPF bytecode, JIT-compiled to native code via a vendored uBPF, and run on every request inside the server’s own unprivileged process. A pointer cage masks memory accesses to substitute for the kernel verifier, and a preemption timer interrupts runaway scripts so one slow handler can’t stall the event loop. Helpers cover request mutation, rate limiting, JSON, AWS SigV4, and a full OIDC relying-party flow with sealed cookies.

The pitch against nginx and Caddy is consolidation: instead of declarative directives that quietly accumulate control flow plus a bolted-on Lua or plugin layer, the whole request path lives in one readable program. Single-core benchmarks against nginx 1.26 and Caddy 2.11 show roughly 17% higher throughput on small static files over HTTPS, with the scaling model assumed to be more processes rather than more threads.