From 79cfcb9966c298dfb416470c9e5dada503eab4df Mon Sep 17 00:00:00 2001 From: Kuzz007 Date: Sun, 26 Jul 2026 11:27:55 +0300 Subject: [PATCH] docs(docker): note that AmneziaWG doesn't work in this image Investigated: the image is Alpine-based, and AmneziaWG's own packaging (DKMS module + amneziawg-tools) doesn't target Alpine/musl at all -- unlike the Debian/Ubuntu/Fedora/Arch paths install.sh already handles, there's no package to apk add even with full host network/capabilities. The panel already degrades gracefully (IsAwgInstalled() logs one warning instead of retrying forever), so no code change is needed -- just made the reason explicit at the point where a user would reach for cap_add/ network_mode to try to work around it. --- docker-compose.yml | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/docker-compose.yml b/docker-compose.yml index a4c88c004..39757e26d 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -12,6 +12,15 @@ services: # with iptables, which needs NET_ADMIN. Without these caps a ban is logged # and shown in fail2ban status but never actually applied. NET_RAW covers # ip6tables. If you disable Fail2ban, you can drop cap_add. + # + # This does NOT make AmneziaWG inbounds work: the image is Alpine-based, + # and AmneziaWG's own packaging (DKMS module + amneziawg-tools) doesn't + # target Alpine/musl at all, unlike the Debian/Ubuntu/Fedora/Arch paths + # install.sh already handles. The panel itself runs fine either way -- + # IsAwgInstalled() just logs one warning instead of retrying forever -- + # but an AmneziaWG inbound's tunnel will never come up from this + # container, no matter what capabilities or network mode you add. Run + # natively on the host if you plan to use AmneziaWG. cap_add: - NET_ADMIN - NET_RAW