From 7e2b133946f5aef67670f989c85f332c26e8caec Mon Sep 17 00:00:00 2001 From: Hermes Date: Wed, 13 May 2026 12:57:12 -0400 Subject: [PATCH] fix: use ln -sf instead of update-alternatives --set update-alternatives fails because iptables-nft isn't registered as an alternative key (only iptables-legacy was registered by the official Dockerfile). Direct symlink override works. --- vpn/Dockerfile | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/vpn/Dockerfile b/vpn/Dockerfile index 08143b7..b86a72c 100644 --- a/vpn/Dockerfile +++ b/vpn/Dockerfile @@ -2,8 +2,8 @@ # Fixes crash-loop when host kernel lacks legacy iptable_nat module. FROM ghcr.io/wg-easy/wg-easy:latest -# The upstream image defaults to iptables-legacy via update-alternatives. -# Switch iptables to the nftables backend (already provided by the 'iptables' -# package on Alpine 3.18+). No apk add needed — iptables-nft is built-in. -RUN update-alternatives --set iptables /usr/sbin/iptables-nft && \ - update-alternatives --set ip6tables /usr/sbin/ip6tables-nft +# The upstream image registers only iptables-legacy with update-alternatives. +# iptables-nft binary exists but isn't registered as an alternative. +# Override the alternatives-managed symlinks directly. +RUN ln -sf /usr/sbin/iptables-nft /usr/sbin/iptables && \ + ln -sf /usr/sbin/ip6tables-nft /usr/sbin/ip6tables