linuxserver/docker-wireguard is a Docker container that runs WireGuard, a modern VPN implementation using state-of-the-art cryptography.
The container solves the problem of deploying WireGuard in containerized environments by packaging it with the LinuxServer.io team's standard container practices. It handles WireGuard module detection and loading at startup, checking whether the wireguard kernel module is already installed before proceeding. The container can operate in either server or client mode depending on the parameters supplied. It includes features for easy user mappings via PGID and PUID environment variables, uses an s6 overlay for process management, and incorporates weekly base OS updates shared across the LinuxServer.io ecosystem to reduce image size and bandwidth overhead.
Developers should choose this container if they want a maintained, regularly updated WireGuard deployment without managing the VPN software directly. It suits projects requiring a lightweight VPN solution in containerized infrastructure. The container supports multiple architectures including x86-64 and arm64, with automatic architecture detection when pulling the latest image. Users need to ensure the wireguard kernel module is enabled on the host system before starting the container. Some host systems may require the SYS_MODULE capability to be assigned and the /lib/modules volume mounted so the container can load iptables kernel modules, or alternatively these modules can be loaded from the host beforehand.
The project receives regular and timely application updates alongside weekly base OS updates. Security updates are applied regularly as part of the maintenance cycle.
