diff --git a/gokrazy/Makefile b/gokrazy/Makefile
index f086dd26b..c746fb74a 100644
--- a/gokrazy/Makefile
+++ b/gokrazy/Makefile
@@ -1,3 +1,5 @@
+# ./qemu-wrapper /tmp/qemu.sock qemu-system-x86_64 [...] -netdev socket,id=vlan,fd=3 -device virtio-net-pci,netdev=vlan
+
 help:
 	echo "See Makefile"
 
@@ -6,3 +8,6 @@ image:
 
 qemu: image
 	qemu-system-x86_64 -m 1G -drive file=tsapp.img,format=raw -boot d -netdev user,id=user.0 -device virtio-net-pci,netdev=user.0 -serial mon:stdio -audio none
+
+qemuwrap: image
+	go run ./cmd/vnetwrap qemu-system-x86_64 -m 1G -drive file=tsapp.img,format=raw -boot d -netdev socket,fd=3,id=user.0 -device virtio-net-pci,netdev=user.0 -serial mon:stdio -audio none
diff --git a/gokrazy/cmd/vnetwrap/vnetwrap.go b/gokrazy/cmd/vnetwrap/vnetwrap.go
new file mode 100644
index 000000000..d8dae280c
--- /dev/null
+++ b/gokrazy/cmd/vnetwrap/vnetwrap.go
@@ -0,0 +1,59 @@
+package main
+
+import (
+	"log"
+	"net"
+	"os"
+	"os/exec"
+)
+
+const path = "/tmp/vnet.sock"
+
+func serve(ln net.Listener) {
+	for {
+		c, err := ln.Accept()
+		if err != nil {
+			log.Printf("Accept: %v", err)
+			continue
+		}
+		go serveConn(c)
+	}
+}
+
+func serveConn(c net.Conn) {
+	log.Printf("Got conn")
+	defer c.Close()
+
+	buf := make([]byte, 4<<10)
+	for {
+		n, err := c.Read(buf)
+		log.Printf("Read: (%v, %v): %02x", n, err, buf[:n])
+		if err != nil {
+			return
+		}
+	}
+}
+
+func main() {
+	srv, err := net.Listen("unix", path)
+	if err != nil {
+		log.Fatal(err)
+	}
+	go serve(srv)
+	conn, err := net.Dial("unix", path)
+	if err != nil {
+		log.Fatal(err)
+	}
+	fd, err := conn.(*net.UnixConn).File()
+	if err != nil {
+		log.Fatal(err)
+	}
+	cmd := exec.Command(os.Args[1], os.Args[2:]...) // #nosec G204
+	cmd.ExtraFiles = append(cmd.ExtraFiles, fd)
+	cmd.Stdin = os.Stdin
+	cmd.Stdout = os.Stdout
+	cmd.Stderr = os.Stderr
+	if err := cmd.Run(); err != nil {
+		log.Fatal(err)
+	}
+}