(I am a Nebula maintainer.) We recently merged support for gVisor-based services, although it's very new, and I don't know of much experimentation that's been done with it yet: https://github.com/slackhq/nebula/pull/965
Really cool! I guess that there's little differences other than noisysockets is explicitly WireGuard compatible (but I actually prefer Nebulas tweaks to the wire protocol).
I actually had some folks from OpenZiti reach out and they have another similar tool in this space.
Some similarities: though when app embedded we are not using a user space TCP stack, we have a suite of SDKs so that you can embed the ingress/egress, authentication, mTLS, E2EE, etc directly into your app, really easily - https://openziti.io/docs/reference/developer/sdk/. When using the Ziti tunnelers on host OS we use a TCP stack.
