Run any OCI/Docker image as a hardware-isolated microVM on macOS HVF (Linux KVM and Windows WHP in progress). Single library API, zero flags for the common case, sub-100 ms cold-restore from snapshot.
// PORT TARGET: devices/src/virtio/vsock/tsi_dgram.rs
// Source size: 471 LOC
// Status: skeleton (no impl)
//// UDP proxy: sendto staging + persistent UdpSocket per (local_port, peer_port). Reverse path via mio recv. Port AFTER inbound stream works