ZeroTier's network controller is source-available, not open source

The network controller is in a separately licensed directory

The licence section of the file is three paragraphs and the second one matters more than the first. Code in node/, osdep/ and service/, and everywhere else, is under the MPL, except for two directories. Code in nonfree/ is under a separate licence described as covering the non-free, source available, portions of the repository, and the quick links point at nonfree/controller/README.md as the network controller. Code in ext/ is external code included for build convenience or backward compatibility and keeps its original licence. So the component that decides who may join a network is source available rather than open source, and a requirement that the whole stack be auditable open source is not met by this repository. The practical step is to read nonfree/LICENSE.md rather than assuming the root licence covers everything, especially since the repository's licence metadata carries no identifier while two licence files, LICENSE-MPL.txt and LICENSE.txt, sit at the root.

VL1 under VL2: an addressed network with an Ethernet layer on top

The mechanism is described in one sentence and it is the whole design. ZeroTier combines a cryptographically addressed and secure peer-to-peer network, termed VL1, with an Ethernet emulation layer somewhat similar to VXLAN, termed VL2. The consequence is the abstraction level. A physical device, a virtual machine and a container appear on one virtual network as if they all resided in the same physical data centre or cloud region, without a layer 3 hop between them. That is why it is described as a switch rather than a tunnel, and why it works for broadcast and discovery protocols that assume a shared segment. The feature list for the emulation layer leans organisational, with fine grained access control rules for network micro-segmentation and security monitoring, so the tool is aimed at teams that have a network function rather than a single developer with two machines.

Most traffic is direct, and the relay fallback is free and slow

One sentence in the about section tells you what the performance will feel like. Most traffic flows peer to peer, and for users who cannot establish a peer-to-peer connection, relaying is offered and described as free but slow. That is an unusual combination and worth sitting with. The direct path is the normal case, so a network between two machines that can reach each other has no relay in it and no operator in the path. The fallback exists for the case that matters operationally, which is one side behind a symmetric NAT or a corporate firewall, and there the throughput and latency are the relay's, and the relay is free. The tree also carries scripts for building and cycling controllers.

Keys are yours, which is the claim and the constraint

All ZeroTier traffic is encrypted end to end using secret keys that only you control. That sentence is the security case and it is stronger than a hosted VPN can make, because the operator is not a party to the traffic. It also carries the usual consequence of end-to-end encryption: nobody else, including the project, can recover what your network carries, so there is no support path that involves reading a payload. Read together with the licensing split, the trust boundary is precise. You trust the node software you run and the controller you operate, not the network between them, and you do not get whatever a managed service would offer in exchange. Mobile clients exist for Android and iOS and are free in the two app stores, which is the one part of the system a user meets without choosing a licence.

The build branches on uname, and the BSD targets force clang

The root makefile is short and it tells you the platform story. It takes the operating system from uname and includes make-mac.mk on Darwin, make-linux.mk on Linux, and the BSD makefiles for the other three. FreeBSD and OpenBSD are handled together, with the compiler explicitly set to clang and clang++ and a numeric platform identifier, seven for FreeBSD and nine for OpenBSD, which tells you the build distinguishes BSD flavours rather than treating them as another Linux. NetBSD gets its own makefile. Windows is not in this makefile at all; the tree has a windows directory and windows-clean.bat, alongside a release Dockerfile, a continuous integration Dockerfile and a vcpkg manifest, while macOS also carries a Brewfile. Platform support is therefore a set of maintained build paths rather than a portability claim.

The CI configuration is generated from jsonnet and then signed

One make target is worth quoting in full, because it is unusual to see in a project that is not a build system:

drone jsonnet --format --stream
drone sign zerotier/ZeroTierOne --save

That is the pipeline: render the configuration from a jsonnet source and then sign it. The target says it renders .drone.yaml from .drone.jsonnet and then signs it. For a networking project that has a service API and a controller, signing the definition of what gets built is a supply chain decision rather than a formality. A second target runs clang-format over node, osdep, service, tcp-proxy and nonfree/controller, and that directory list is itself a map of the code the project formats, which is a narrower set than the whole tree.

Two releases on one day in May, on a default branch called dev

The release list is where you would look for a maintenance signal, and it needs reading carefully. Version 1.16.0 was published on 2025-09-11, and then 1.16.1 and 1.16.2 were both published on 2026-05-28, minutes apart, with the last push recorded for the repository on 2026-09-03. The default branch is dev rather than a release branch, so a clone gives you development code and the documentation site is where the downloads and installation instructions are. Two patch releases in the same day is a reason to read the release notes before pinning a version rather than a reason for concern, and the repository keeps a release notes file at the root for exactly that. There is also an attic/ directory, which is where a long-lived tree puts the things it no longer builds, and its presence is a fair signal about the age of the code base.

Editorial conclusion

ZeroTier fits a team that wants layer 2 reachability between machines it controls, across several environments, without a tunnel per pair, and that is willing to accept a fallback path when a direct one cannot be built. It does not fit a requirement for audited open source across the whole stack, because the network controller sits in a directory with its own source-available licence, and it does not fit a latency-sensitive path between endpoints behind restrictive NATs, since the fallback is described as free but slow. Before you adopt it, read the licence in that directory rather than the one at the root, and check the repository's licence metadata, which carries no identifier at all. Then read the release notes before pinning a version, because 1.16.1 and 1.16.2 were both published on 2026-05-28 and the default branch is dev.

Frequently asked questions

Official sources

1. Issues
2. Project website
3. README
4. Releases
5. zerotier/ZeroTierOne on GitHub