From 8dff0947686f450f1aa243b6f5da35350a6ef3f7 Mon Sep 17 00:00:00 2001 From: Hermes Date: Wed, 13 May 2026 12:58:43 -0400 Subject: [PATCH] fix: use ln -sf instead of update-alternatives --set update-alternatives --set fails because the base image only registers iptables-legacy as an alternative. The iptables-nft binary (/usr/sbin/iptables-nft) exists but isn't in the alternatives database. Direct ln -sf bypasses this. --- vpn/Dockerfile | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/vpn/Dockerfile b/vpn/Dockerfile index 08143b7..f0c29c9 100644 --- a/vpn/Dockerfile +++ b/vpn/Dockerfile @@ -2,8 +2,8 @@ # Fixes crash-loop when host kernel lacks legacy iptable_nat module. FROM ghcr.io/wg-easy/wg-easy:latest -# The upstream image defaults to iptables-legacy via update-alternatives. -# Switch iptables to the nftables backend (already provided by the 'iptables' -# package on Alpine 3.18+). No apk add needed — iptables-nft is built-in. -RUN update-alternatives --set iptables /usr/sbin/iptables-nft && \ - update-alternatives --set ip6tables /usr/sbin/ip6tables-nft +# The upstream image registers only iptables-legacy with update-alternatives. +# iptables-nft binary exists but isn't registered as an alternative key. +# Override the alternatives-managed symlinks directly. +RUN ln -sf /usr/sbin/iptables-nft /usr/sbin/iptables && \ + ln -sf /usr/sbin/ip6tables-nft /usr/sbin/ip6tables