5e16644902
To remove the need for running privileged mode, set the necessary `net.ipv4.conf.all.src_valid_mark=1` sysctl via docker and modify the `/usr/bin/wg-quick` script from setting the sysctl * Set `net.ipv4.conf.all.src_valid_mark=1` sysctl via docker `--sysctl` * Set CAPs of NET_ADMIN and SYS_MODULE instead of using `--privileged` * Check that `net.ipv4.conf.all.src_valid_mark=1` is set in entrypoint script Fixes #2
38 lines
1.3 KiB
Bash
Executable file
38 lines
1.3 KiB
Bash
Executable file
#!/bin/bash
|
|
|
|
set -e
|
|
|
|
configs=`find /etc/wireguard -type f -printf "%f\n"`
|
|
if [[ -z $configs ]]; then
|
|
echo "No configuration files found in /etc/wireguard" >&2
|
|
exit 1
|
|
fi
|
|
|
|
config=`echo $configs | head -n 1`
|
|
interface="${config%.*}"
|
|
|
|
if [[ "$(cat /proc/sys/net/ipv4/conf/all/src_valid_mark)" != "1" ]]; then
|
|
echo "sysctl net.ipv4.conf.all.src_valid_mark=1 is not set" >&2
|
|
exit 1
|
|
fi
|
|
|
|
sed -i "s:sysctl -q net.ipv4.conf.all.src_valid_mark=1:echo skipping setting net.ipv4.conf.all.src_valid_mark:" /usr/bin/wg-quick
|
|
wg-quick up $interface
|
|
|
|
docker_network="$(ip -o addr show dev eth0 | awk '$3 == "inet" {print $4}')"
|
|
docker_network_rule=$([ ! -z "$docker_network" ] && echo "! -d $docker_network" || echo "")
|
|
iptables -I OUTPUT ! -o $interface -m mark ! --mark $(wg show $interface fwmark) -m addrtype ! --dst-type LOCAL $docker_network_rule -j REJECT
|
|
|
|
docker6_network="$(ip -o addr show dev eth0 | awk '$3 == "inet6" {print $4}')"
|
|
docker6_network_rule=$([ ! -z "$docker6_network" ] && echo "! -d $docker6_network" || echo "")
|
|
ip6tables -I OUTPUT ! -o $interface -m mark ! --mark $(wg show $interface fwmark) -m addrtype ! --dst-type LOCAL $docker6_network_rule -j REJECT
|
|
|
|
shutdown () {
|
|
wg-quick down $interface
|
|
exit 0
|
|
}
|
|
|
|
trap shutdown SIGTERM SIGINT SIGQUIT
|
|
|
|
sleep infinity &
|
|
wait $!
|