Hermes
2bf31c7ccc
- Switch FROM weejewel/wg-easy:latest (4yr old, Alpine 3.11) to ghcr.io/wg-easy/wg-easy:latest (actively maintained, Alpine krypton) - Use update-alternatives instead of raw ln -sf to flip iptables from legacy to nftables backend - Fix compose build context: ./vpn -> . (Dockerfile was at same level) The weejewel/wg-easy image lacked iptables-nft package in Alpine 3.11. The new official image has it available, we just flip the alternatives. The old ln -sf approach was fragile across Alpine versions.
11 lines
546 B
Docker
11 lines
546 B
Docker
# Custom wg-easy with iptables-nft (nftables-backed iptables)
|
|
# Fixes crash-loop when host kernel lacks legacy iptable_nat module.
|
|
FROM ghcr.io/wg-easy/wg-easy:latest
|
|
|
|
# The upstream image defaults to iptables-legacy via update-alternatives.
|
|
# Switch to iptables-nft so it works on kernels where only nftables
|
|
# netfilter modules are available (iptable_nat module missing).
|
|
RUN apk add --no-cache iptables-nft && \
|
|
update-alternatives --set iptables /usr/sbin/iptables-nft && \
|
|
update-alternatives --set ip6tables /usr/sbin/ip6tables-nft
|