noxcis/distroless-wireguard repository overview

⁠docker-wireguard

Distroless WireGuard + AmneziaWG base image for community use. No entrypoint; the only internal service is sleep (default CMD), which keeps the container running as the basis for continuations. Override CMD in a derived image or at run time.

⁠Build

From docker-wireguard root:

docker build -f Dockerfile.wireguard -t distroless-wireguard .

Or with compose:

docker compose build

⁠Use as a base image

In your Dockerfile:

FROM your-registry/distroless-wireguard:latest
COPY wg0.conf /etc/wireguard/
CMD ["wg-quick", "up", "wg0"]

Direct run (you supply the command):

docker run -d --name wireguard \
  --cap-add=NET_ADMIN \
  -p 51820:51820/udp \
  -v /path/to/conf:/etc/wireguard \
  --sysctl net.ipv4.conf.all.src_valid_mark=1 \
  distroless-wireguard wg-quick up wg0

Compose: Override command to run wg-quick or your script; by default the container runs the internal service (sleep) and stays up.

⁠What’s in the image

• WireGuard: wg, wg-quick
• AmneziaWG (AWG): awg, awg-quick, amneziawg-go; config dir /etc/amnezia/amneziawg
• Networking: ip, iptables, ip6tables, modprobe, lsmod, tc, sleep
• Shell: /bin/sh
• Only the shared libs those binaries need; no package manager
• /dev/net/tun for WireGuard/AWG
• Internal service only: no ENTRYPOINT; default CMD ["sleep", "infinity"] keeps the container running as the basis for continuations

⁠Optional “start all .conf” script

entrypoint.sh in this repo starts every *.conf in /etc/wireguard (alphabetically) then runs sleep infinity. Use it in a derived image:

FROM distroless-wireguard:latest
COPY entrypoint.sh /entrypoint.sh
CMD ["/entrypoint.sh"]

(You need to copy entrypoint.sh from this repo into your build context.)

⁠Compatibility

Same runtime contract as procustodibus/wireguard and linuxserver/wireguard (volume /etc/wireguard, NET_ADMIN, port 51820/udp, sysctl for full tunnel). For PUID/PGID-style volume ownership, run with --user PUID:PGID and match host dir ownership.