Skip to content

0.9.0

Choose a tag to compare

View all tags
@azinchen azinchen released this 01 Nov 17:37
· 2 commits to main since this release
0.9.0
ced66a1

First published release of the WireGuard node image: a WireGuard server with zero-config peers, per-peer exits (direct, an upstream VPN container, a WireGuard provider conf, or another peer acting as exit node), a fail-closed kill switch, hot reload, and a sidecar role for other containers. Versioned 0.9.0 while the client-mode semantics are being finalised; the server role is complete and verified on a live deployment.

📥 Pull this release

docker pull azinchen/wireguard:0.9.0
docker pull ghcr.io/azinchen/wireguard:0.9.0

Multi-arch: 386, amd64, arm/v6, arm/v7, arm64, riscv64. latest follows this release.

⬆️ Upgrade notes

First release — nothing to upgrade from. Two behaviours differ from the pre-release dev builds:

  • Traffic between peers (and to allowed= networks behind a peer) now always stays on wg0, whatever gateway the sending peer is mapped to; a peer's gateway applies to its internet traffic only. See Gateway Mode.
  • DNS-named dial-out endpoints are re-resolved automatically once their handshake is older than UPSTREAM_HANDSHAKE_TIMEOUT, without setting VPN_GATEWAYS_RESOLVE_INTERVAL. See Exit Nodes and Upstreams.

✨ Features

  • Zero-config peers (PEERS, peers.conf). A bare name is a complete peer: keys, pre-shared key, stable address, device config and QR code are generated and persisted; name=<pubkey> keeps the private key on the device. See Peers.
  • Per-peer exits (gw=, VPN_PEER_GATEWAY, VPN_GATEWAYS). Each peer leaves direct, through an upstream VPN container (nordvpn, nordvpn-wg, ocserv-server), through a WireGuard provider conf, or through another peer; DNS-named gateways are re-resolved live. Same VPN_GATEWAY* contract as ocserv-server. See Gateway Mode.
  • Exit nodes (exit=true). A peer such as a home router becomes an exit; the image generates its tunnel, keys, port and the config the device imports, dial-in and dial-out. See Exit Nodes and Upstreams.
  • Fail-closed kill switch. nftables guards on every path: an upstream that is down means no internet for its peers, never a leak.
  • Hot reload (wg-reload, PEERS_WATCH). Peers file and maps are applied in place with wg syncconf; unchanged peers keep their session.
  • Sidecar role (LOCAL_GATEWAY, FORWARD_FROM). The container's own traffic and network_mode: service: containers go through a chosen tunnel behind an output kill switch. See Sidecar Mode.
  • Operations. Opt-in HEALTHCHECK with per-gateway egress probes, peer-report, peer-conf --qr, network-diagnostic; kernel WireGuard with wireguard-go fallback; no wg-quick.

🐛 Fixes

  • Peer-to-peer traffic of a gateway-mapped peer left through the gateway instead of wg0 (76cf12a).
  • A failed IPv4 lookup could flip a working IPv4 endpoint to an unreachable IPv6 address during re-resolution; the address family is now sticky (ced66a1).

📦 Package Updates

  • Alpine Linux 3.24.3; curl 8.23.0-r0, bind-tools 9.20.30-r0, ca-certificates 20261020-r0.

📖 Documentation

  • README and wiki aligned with the sibling images; new Building and CI page; release template and release-notes categories.

🔧 CI/CD Updates

  • Bump github/codeql-action from 4.38.2 to 4.39.1 (#4)
  • Bump docker/login-action from 4.6.0 to 4.7.0 (#3)

🧩 Component versions

Component Version
wireguard-tools (wg) 1.0.20260223
wireguard-go (userspace fallback) 0.0.20250522
Alpine Linux 3.24.3
s6-overlay 3.2.3.2

Contributors

@azinchen @dependabot

Full Changelog: https://github.com/azinchen/wireguard/commits/0.9.0

Contributors

dependabot and azinchen
Assets 2
Loading