0.9.1

Bug-fix release for the sidecar role: a container acting as a gateway for other containers (LOCAL_GATEWAY + FORWARD_FROM) did not forward correctly. Upgrade if you use the image that way; the server role is unaffected.

📥 Pull this release

docker pull azinchen/wireguard:0.9.1
docker pull ghcr.io/azinchen/wireguard:0.9.1

Multi-arch: 386, amd64, arm/v6, arm/v7, arm64, riscv64. latest follows this release.

⬆️ Upgrade notes

No action required. One new advanced variable, WG_MARK_RULE_PRIO (default 700), sets the priority of the policy rule that keeps WireGuard's own encrypted UDP on the main table; leave it unless your rule priorities collide. See Sidecar Mode.

🐛 Fixes

• Sidecar gateway forwarded nothing. The local-traffic rule was written as iif lo not fwmark 0xca6c lookup <table>; the kernel inverts a whole rule, so every forwarded packet matched it too and replies for FORWARD_FROM clients were routed back into the upstream tunnel instead of to the client. It is now a plain iif lo lookup <table> rule (2362f5a).
• Half of the sidecar's own tunnel packets were lost when the container's address lies inside FORWARD_FROM (the usual FORWARD_FROM=auto or the Docker subnet): the from <cidr> rule caught the encrypted UDP itself. WireGuard's fwmarked UDP now has its own lookup main rule ahead of every source rule (2362f5a).
• The sidecar did not answer LAN hosts (ping to the gateway container, health probes from neighbours) for the same reason; NETWORK and FORWARD_FROM destinations are now pinned to the main table at priority 800 (2362f5a).

📖 Documentation

• Sidecar Mode, Architecture and Internals and the Configuration Reference describe the two-rule mechanism and WG_MARK_RULE_PRIO.

🧩 Component versions

Component	Version
wireguard-tools (wg)	1.0.20260223
wireguard-go (userspace fallback)	0.0.20250522
Alpine Linux	3.24.3
s6-overlay	3.2.3.2

Contributors

@azinchen

Full Changelog: 0.9.0...0.9.1