0.9.1

Bug-fix release for the sidecar role: a container acting as a gateway for other containers (LOCAL_GATEWAY + FORWARD_FROM) did not forward correctly. Upgrade if you use the image that way; the server role is unaffected.

📥 Pull this release

docker pull azinchen/wireguard:0.9.1
docker pull ghcr.io/azinchen/wireguard:0.9.1

Multi-arch: 386, amd64, arm/v6, arm/v7, arm64, riscv64. latest follows this release.

⬆️ Upgrade notes

No action required. One new advanced variable, WG_MARK_RULE_PRIO (default 700), sets the priority of the policy rule that keeps WireGuard's own encrypted UDP on the main table; leave it unless your rule priorities collide. See Sidecar Mode.

🐛 Fixes

• Sidecar gateway forwarded nothing. The local-traffic rule was written as iif lo not fwmark 0xca6c lookup <table>; the kernel inverts a whole rule, so every forwarded packet matched it too and replies for FORWARD_FROM clients were routed back into the upstream tunnel instead of to the client. It is now a plain iif lo lookup <table> rule (2362f5a).
• Half of the sidecar's own tunnel packets were lost when the container's address lies inside FORWARD_FROM (the usual FORWARD_FROM=auto or the Docker subnet): the from <cidr> rule caught the encrypted UDP itself. WireGuard's fwmarked UDP now has its own lookup main rule ahead of every source rule (2362f5a).
• The sidecar did not answer LAN hosts (ping to the gateway container, health probes from neighbours) for the same reason; NETWORK and FORWARD_FROM destinations are now pinned to the main table at priority 800 (2362f5a).

📖 Documentation

• Sidecar Mode, Architecture and Internals and the Configuration Reference describe the two-rule mechanism and WG_MARK_RULE_PRIO.

🧩 Component versions

Component	Version
wireguard-tools (wg)	1.0.20260223
wireguard-go (userspace fallback)	0.0.20250522
Alpine Linux	3.24.3
s6-overlay	3.2.3.2

Contributors

@azinchen

Full Changelog: 0.9.0...0.9.1

0.9.0

First published release of the WireGuard node image: a WireGuard server with zero-config peers, per-peer exits (direct, an upstream VPN container, a WireGuard provider conf, or another peer acting as exit node), a fail-closed kill switch, hot reload, and a sidecar role for other containers. Versioned 0.9.0 while the client-mode semantics are being finalised; the server role is complete and verified on a live deployment.

📥 Pull this release

docker pull azinchen/wireguard:0.9.0
docker pull ghcr.io/azinchen/wireguard:0.9.0

Multi-arch: 386, amd64, arm/v6, arm/v7, arm64, riscv64. latest follows this release.

⬆️ Upgrade notes

First release — nothing to upgrade from. Two behaviours differ from the pre-release dev builds:

• Traffic between peers (and to allowed= networks behind a peer) now always stays on wg0, whatever gateway the sending peer is mapped to; a peer's gateway applies to its internet traffic only. See Gateway Mode.
• DNS-named dial-out endpoints are re-resolved automatically once their handshake is older than UPSTREAM_HANDSHAKE_TIMEOUT, without setting VPN_GATEWAYS_RESOLVE_INTERVAL. See Exit Nodes and Upstreams.

✨ Features

• Zero-config peers (PEERS, peers.conf). A bare name is a complete peer: keys, pre-shared key, stable address, device config and QR code are generated and persisted; name=<pubkey> keeps the private key on the device. See Peers.
• Per-peer exits (gw=, VPN_PEER_GATEWAY, VPN_GATEWAYS). Each peer leaves direct, through an upstream VPN container (nordvpn, nordvpn-wg, ocserv-server), through a WireGuard provider conf, or through another peer; DNS-named gateways are re-resolved live. Same VPN_GATEWAY* contract as ocserv-server. See Gateway Mode.
• Exit nodes (exit=true). A peer such as a home router becomes an exit; the image generates its tunnel, keys, port and the config the device imports, dial-in and dial-out. See Exit Nodes and Upstreams.
• Fail-closed kill switch. nftables guards on every path: an upstream that is down means no internet for its peers, never a leak.
• Hot reload (wg-reload, PEERS_WATCH). Peers file and maps are applied in place with wg syncconf; unchanged peers keep their session.
• Sidecar role (LOCAL_GATEWAY, FORWARD_FROM). The container's own traffic and network_mode: service: containers go through a chosen tunnel behind an output kill switch. See Sidecar Mode.
• Operations. Opt-in HEALTHCHECK with per-gateway egress probes, peer-report, peer-conf --qr, network-diagnostic; kernel WireGuard with wireguard-go fallback; no wg-quick.

🐛 Fixes

• Peer-to-peer traffic of a gateway-mapped peer left through the gateway instead of wg0 (76cf12a).
• A failed IPv4 lookup could flip a working IPv4 endpoint to an unreachable IPv6 address during re-resolution; the address family is now sticky (ced66a1).

📦 Package Updates

• Alpine Linux 3.24.3; curl 8.23.0-r0, bind-tools 9.20.30-r0, ca-certificates 20261020-r0.

📖 Documentation

• README and wiki aligned with the sibling images; new Building and CI page; release template and release-notes categories.

🔧 CI/CD Updates

• Bump github/codeql-action from 4.38.2 to 4.39.1 (#4)
• Bump docker/login-action from 4.6.0 to 4.7.0 (#3)

🧩 Component versions

Component	Version
wireguard-tools (wg)	1.0.20260223
wireguard-go (userspace fallback)	0.0.20250522
Alpine Linux	3.24.3
s6-overlay	3.2.3.2

Contributors

@azinchen @dependabot

Full Changelog: https://github.com/azinchen/wireguard/commits/0.9.0