Awesome
wireguard-docker
A Docker image containing Wireguard that enables containerized VPNs. Containers that use this image can provide VPN services to other Docker containers by sharing the same Docker network.
Requirements
Unfortunately, due to Wireguard's kernel module, this image only run on kernels where Ubuntu 16.04, the OS for the base image, can pull down kernel headers. This has been verified to work on kernels 4.13 and newer.
Image
An up-to date Docker image can be found on Dockerhub at
activeeos/wireguard-docker
. To pull:
$ docker pull activeeos/wireguard-docker
Usage
Configuration
A volume has to be mounted at /etc/wireguard
containing a single
configuration file with a .conf
extension corresponding to the VPN
interface.
More information about the structure of this file can be found in the Wireguard man page and on its website.
Note: if Wireguard is running as a server, the UDP port that it listens on has to be exposed from the container.
Kernel Modules
A custom kernel module is installed when the container boots up. In
order for this process to work, the underlying system either already
needs to have Wireguard installed or the host modules directory needs
to be shared with the container. Specifically, the /lib/modules
directory needs to be mapped to /lib/modules
in the container. This
can be done with the -v /lib/modules:/lib/modules
flag in docker run
.
Permissions
When running a container based upon this image, the following system capabilities are necessary:
- NET_ADMIN
- SYS_MODULE
Example docker run
command
docker run -it --rm --cap-add net_admin --cap-add sys_module \
-v /etc/wireguard:/etc/wireguard -v /lib/modules:/lib/modules \
-p 5555:5555/udp activeeos/wireguard-docker
Inspiration
Thanks to Nick Babcock for his blog post explaining the mechanics behind running Wireguard inside of a container.