Merge pull request 'fix: add iptables-nft to wg-easy for nftables-only kernels' (#24 ) from fix/wg-easy-iptables-nft into master

Reviewed-on: #24
Merge pull request 'feat: install custom Hermes tools at startup, remove deprecated fix-permissions.sh' (#23 ) from feat/hermes-custom-tools-startup into master
2026-05-13 15:03:25 +00:00 · 2026-05-13 13:52:36 +00:00 · 2026-05-12 14:52:33 -04:00
2 changed files with 20 additions and 1 deletions
--- a/vpn/Dockerfile
+++ b/vpn/Dockerfile
@@ -0,0 +1,16 @@
+# Custom wg-easy with iptables-nft (nftables-backed iptables)
+# Fixes crash-loop when host kernel lacks legacy iptable_nat module.
+FROM weejewel/wg-easy:latest
+
+# Alpine's iptables-nft provides iptables that uses nftables kernel API
+# instead of the legacy iptable_nat module. This works on kernels
+# where only nftables netfilter modules are available.
+RUN apk add --no-cache iptables-nft
+
+# Ensure iptables-nft takes priority over legacy iptables
+RUN ln -sf /sbin/iptables-nft /sbin/iptables && \
+    ln -sf /sbin/iptables-nft-save /sbin/iptables-save && \
+    ln -sf /sbin/iptables-nft-restore /sbin/iptables-restore && \
+    ln -sf /sbin/ip6tables-nft /sbin/ip6tables && \
+    ln -sf /sbin/ip6tables-nft-save /sbin/ip6tables-save && \
+    ln -sf /sbin/ip6tables-nft-restore /sbin/ip6tables-restore
--- a/vpn/compose.yml
+++ b/vpn/compose.yml
@@ -2,7 +2,10 @@ version: "3.8"

 services:
  wireguard:
-    image: weejewel/wg-easy:latest
+    build:
+      context: ./vpn
+      dockerfile: Dockerfile
+    image: wg-easy-iptables-nft:latest
    container_name: wireguard
    cap_add:
      - NET_ADMIN
Author	SHA1	Message	Date
Thierry Pouplier	4cdd157e3f	Merge pull request 'fix: add iptables-nft to wg-easy for nftables-only kernels' (#24 ) from fix/wg-easy-iptables-nft into master Reviewed-on: #24	2026-05-13 15:03:25 +00:00
Thierry Pouplier	3ba0345887	Merge pull request 'feat: install custom Hermes tools at startup, remove deprecated fix-permissions.sh' (#23 ) from feat/hermes-custom-tools-startup into master Some checks failed Build Hermes agent / build (push) Failing after 2s Details Build ollama (gfx906) / build (push) Failing after 2s Details Reviewed-on: #23	2026-05-13 13:52:36 +00:00
Hermes	5e242eb946	fix: add iptables-nft to wg-easy for nftables-only kernels wg-easy's Alpine wg-quick uses legacy iptables which requires the iptable_nat kernel module. On NixOS kernels compiled without legacy netfilter modules, the container crashes in a restart loop: iptables v1.8.3 (legacy): can't initialize iptables table 'nat' Table does not exist (do you need to insmod?) Fix: build a custom image that installs Alpine's iptables-nft package and symlinks iptables -> iptables-nft (nftables backend).	2026-05-12 14:52:33 -04:00