# Custom wg-easy with iptables-nft (nftables-backed iptables)
# Fixes crash-loop when host kernel lacks legacy iptable_nat module.
FROM ghcr.io/wg-easy/wg-easy:latest

# The upstream image defaults to iptables-legacy via update-alternatives.
# Switch to iptables-nft so it works on kernels where only nftables
# netfilter modules are available (iptable_nat module missing).
RUN apk add --no-cache iptables-nft && \
    update-alternatives --set iptables /usr/sbin/iptables-nft && \
    update-alternatives --set ip6tables /usr/sbin/ip6tables-nft