# Custom wg-easy with iptables-nft (nftables-backed iptables)
# Fixes crash-loop when host kernel lacks legacy iptable_nat module.
FROM ghcr.io/wg-easy/wg-easy:latest

# The upstream image defaults to iptables-legacy via update-alternatives.
# Switch iptables to the nftables backend (already provided by the 'iptables'
# package on Alpine 3.18+). No apk add needed — iptables-nft is built-in.
RUN update-alternatives --set iptables /usr/sbin/iptables-nft && \
    update-alternatives --set ip6tables /usr/sbin/ip6tables-nft