Merge pull request 'fix: use ln -sf instead of update-alternatives --set for iptables-nft' (#28 ) from fix/vpn-iptables-nft-v3 into master

Reviewed-on: #28
fix: use ln -sf instead of update-alternatives --set
2026-05-13 16:59:50 +00:00 · 2026-05-13 12:58:43 -04:00 · 2026-05-13 16:49:23 +00:00 · 2026-05-13 12:48:51 -04:00 · 2026-05-13 16:37:35 +00:00
1 changed files with 5 additions and 6 deletions
--- a/vpn/Dockerfile
+++ b/vpn/Dockerfile
@@ -2,9 +2,8 @@
 # Fixes crash-loop when host kernel lacks legacy iptable_nat module.
 FROM ghcr.io/wg-easy/wg-easy:latest
-# The upstream image defaults to iptables-legacy via update-alternatives.
+# The upstream image registers only iptables-legacy with update-alternatives.
-# Switch to iptables-nft so it works on kernels where only nftables
+# iptables-nft binary exists but isn't registered as an alternative key.
-# netfilter modules are available (iptable_nat module missing).
+# Override the alternatives-managed symlinks directly.
-RUN apk add --no-cache iptables-nft && \
+RUN ln -sf /usr/sbin/iptables-nft /usr/sbin/iptables && \
-    update-alternatives --set iptables /usr/sbin/iptables-nft && \
+    ln -sf /usr/sbin/ip6tables-nft /usr/sbin/ip6tables
    update-alternatives --set ip6tables /usr/sbin/ip6tables-nft
Author	SHA1	Message	Date
Thierry Pouplier	29ae32a1c5	Merge pull request 'fix: use ln -sf instead of update-alternatives --set for iptables-nft' (#28 ) from fix/vpn-iptables-nft-v3 into master Reviewed-on: #28	2026-05-13 16:59:50 +00:00
Hermes	8dff094768	fix: use ln -sf instead of update-alternatives --set update-alternatives --set fails because the base image only registers iptables-legacy as an alternative. The iptables-nft binary (/usr/sbin/iptables-nft) exists but isn't in the alternatives database. Direct ln -sf bypasses this.	2026-05-13 12:58:43 -04:00
Thierry Pouplier	ec08f5eb5d	Merge pull request 'fix: remove apk add iptables-nft — built-in on Alpine 3.18+' (#27 ) from fix/vpn-iptables-nft-v2 into master Reviewed-on: #27	2026-05-13 16:49:23 +00:00
Hermes	611e96b306	fix: remove apk add iptables-nft — built-in on Alpine 3.18+ In Alpine 3.18+, the 'iptables' package IS the nftables variant. iptables-nft is not a separate package. The binary is already in the base image — only need to flip update-alternatives.	2026-05-13 12:48:51 -04:00
Thierry Pouplier	f184ed957c	Merge pull request 'fix: update wg-easy to official ghcr image with iptables-nft' (#26 ) from fix/vpn-iptables-nft-upstream into master Reviewed-on: #26	2026-05-13 16:37:35 +00:00