simono41/docker-wireguard
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

Remove need for running in privileged mode

Browse source 
To remove the need for running privileged mode, set the necessary
`net.ipv4.conf.all.src_valid_mark=1` sysctl via docker and modify the
`/usr/bin/wg-quick` script from setting the sysctl

* Set `net.ipv4.conf.all.src_valid_mark=1` sysctl via docker `--sysctl`

* Set CAPs of NET_ADMIN and SYS_MODULE instead of using `--privileged`

* Check that `net.ipv4.conf.all.src_valid_mark=1` is set in entrypoint
  script

Fixes #2
This commit is contained in:
bobbypage 2020-09-12 21:26:51 +00:00
parent ac2b0180ae
commit 5e16644902
2 changed files with 9 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
README.md
View file

@ -9,7 +9,9 @@ Now simply mount the configuration file and run! For example, if your configurat
```bash ```bash
docker run --name wireguard \ docker run --name wireguard \
--privileged \ --cap-add NET_ADMIN \
--cap-add SYS_MODULE \
--sysctl net.ipv4.conf.all.src_valid_mark=1 \
-v /path/to/conf/mullvad.conf:/etc/wireguard/mullvad.conf \ -v /path/to/conf/mullvad.conf:/etc/wireguard/mullvad.conf \
jordanpotter/wireguard jordanpotter/wireguard
``` ```

6
entrypoint.sh
View file

@ -11,6 +11,12 @@ fi
config=`echo $configs | head -n 1` config=`echo $configs | head -n 1`
interface="${config%.*}" interface="${config%.*}"
if [[ "$(cat /proc/sys/net/ipv4/conf/all/src_valid_mark)" != "1" ]]; then
echo "sysctl net.ipv4.conf.all.src_valid_mark=1 is not set" >&2
exit 1
fi
sed -i "s:sysctl -q net.ipv4.conf.all.src_valid_mark=1:echo skipping setting net.ipv4.conf.all.src_valid_mark:" /usr/bin/wg-quick
wg-quick up $interface wg-quick up $interface
docker_network="$(ip -o addr show dev eth0 | awk '$3 == "inet" {print $4}')" docker_network="$(ip -o addr show dev eth0 | awk '$3 == "inet" {print $4}')"