Wireguard status

[Nozzie]

Hi all,

It looks like the wireguard implementation has not been worked on the last two years.
Is it still in something that is planned to be implemented? Is there someone working on this?
More and more providers are offering wireguard now, so this would be a welcome addition to the image.

Regards

[ilike2burnthing]

Given it only ever got 4 commits over a 3 days, a year and a half ago, I'd imagine this is very much in the realm of 'if someone else submits a PR, great, otherwise...'.

[ilike2burnthing]

Looks like you might be in luck. The old wireguard branch has been renamed old-wg, and there is now a new branch named wg with a new commit an hour ago from the man himself.

[Nozzie]

I had a look at the wireguard branch. I got the vpn to work for my vpn provider, but the resulting docker image is huge. Wireguard wants to be able to build a kernel module with dkms, so it has a huge list of dependencies that all get installed into the image. The final image was 1.45GB

When looking for more efficient ways to build a wireguard image, I found this procedure to use separate containers for all services. It seems like a neat and tidy alternative to haugene's image.

[ilike2burnthing]

@haugene ^

[haugene]

Thanks for the heads up @ilike2burnthing. Hadn't seen this thread :) About the integration of Wireguard it's like you say. I spent some days on it a couple of years ago but didn't finish and life got too busy so I've been waiting for a great PR to come along ever since 👼

But... Life is getting less busy these days and Wireguard has grown even more relevant so I'm hoping to get something launched quite soon. I've been tinkering locally and have something working so I started to rename and move some branches yesterday. More info will come soon when a beta-version is ready. I'll start off a bit plain (no privoxy, no ufw, ...) but functional and then I hope to get some feedback on how it works.

Finally - to your comment about separate containers for all services @Nozzie. That is definitely a great way to go, given that you know what you're doing. It gives you great flexibility and is in line with "the container way" to think with one service per container.
There are a couple of benefits to having it in the same container like it's easier to make the whole thing restart if either process fails etc - but I think the primary reason people are using this image is to not have to deal with iptables, ip route ... commands, masquerading and that stuff :)

In my work with Wireguard now I'm going to use "The New Namespace Solution" described here: https://www.wireguard.com/netns/. That feels really secure and quite elegant. There are many ways of achieving similar results and all roads lead to Rome I guess :)

[haugene]

I'll close this as I've created a new discussion here: #2608

I think the questions in your original post is partly answered and should be followed up there. As for just running a Wireguard container and doing the routing yourself that's also an option as I said, but not so relevant for this image as this image seeks to combine it :)