First of all, I know that there is an integrated Version of Wireguard inside of unRAID. Yet there are arguments for different versions.

I want to use the WG-Easy Container as I have used it before and it has a really nice and quick way of setting up clients including QR-Codes for phones. Also it lets me import my old WG-easy config from my Pi4.

In case you don't know WG-Easy it is a GUI for Wireguard https://wg-easy.github.io/wg-easy/latest

Now to my issue: I managed to get the container to run inside of unRAID docker but I have some issues regarding the network connectivity.

[unhandledRejection] Error: WireGuard exited with the error: Cannot find device "wg0"
This usually means that your host's kernel does not support WireGuard!
    at file:///app/server/chunks/nitro/nitro.mjs:5823:15
    at process.processTicksAndRejections (node:internal/process/task_queues:105:5)
    at async WireGuard.Startup (file:///app/server/chunks/nitro/nitro.mjs:5821:5) {
  [cause]: 'Command failed: wg-quick up wg0\n' +
    '[#] ip link add dev wg0 type wireguard\n' +
    'RTNETLINK answers: Operation not permitted\n' +
    'Unable to access interface: Operation not permitted\n' +
    '[#] ip link delete dev wg0\n' +
    'Cannot find device "wg0"\n'
}
Migrating database...
====================================================
    wg-easy - https://github.com/wg-easy/wg-easy    
====================================================
| wg-easy:  v15.1.0                                |
| Node:     v22.17.0                               |
| Platform: linux                                  |
| Arch:     x64                                    |
====================================================
Migration complete
Starting WireGuard...
Starting Wireguard Interface wg0...
Saving Config...
Listening on http://0.0.0.0:51821
Config saved successfully.
$ wg-quick down wg0
$ wg-quick up wg0

Based on the error you can see that the network connection fails at the moment due to the inability to access wg0 as network adapter.

There is a wg0 docker network but no Linux system network adapter.

Can you help me with fixing this issue. I think it could be something like passing a network device from /sys/class/net/ (?) to the container.

PS: I know that this topic is more related to Docker Containers than General Support but as I'm not a verified developer I cannot post in the forum. Feel free to move this topic to where it fits best.

This method is called sidecar and is and can be used in conjunction with other dockers and docker networks...

You should run the wg docker in custom br0/eth0/bond0 (depending on your network connections..)

https://www.youtube.com/watch?v=bKFMS5C4CG0

Brandon Martino - Personal Site

Guide-DockerNetworks

Brandon Martino - Personal Site

once you get your wiregaurd instance up you would usualy use container network this WireGuard docker name or docker network cli commands to connect things to this docker...

also you need to pass cap system to the docker due to the tunnel and access to network tunnels...

when messing with mutiple docekr networks on unraid I pref to use compose... as teh unraid docker tempates build a docker run line and some edits, option and data is not there to use the system...


so to clerify your docker is missing some key data...

this is not a missing kernel module, it’s a Docker capability / device permission failure on Unraid.
*That means the container is not allowed to create a network interface.

WireGuard inside a container needs three things that Docker does not grant by default:

1. Capability to create network interfaces

2. Capability to configure them

3. Access to /dev/net/tun

Without those, wg-quick up wg0 will always fail exactly like this.

Potental Fixes:
add this line to your extra parm:
--cap-add=NET_ADMIN --cap-add=SYS_MODULE --cap-add=NET_RAW --device=/dev/net/tun

and use docker network mode host or custom br0...

again I prefer compose i would run this...

#version: "3.8"

services:
  wireguard:
    image: ghcr.io/wg-easy/wg-easy:latest
    container_name: wireguard
    network_mode: host

    cap_add:
      - NET_ADMIN
      - SYS_MODULE
      - NET_RAW

    devices:
      - /dev/net/tun:/dev/net/tun

    volumes:
      - /mnt/user/appdata/wireguard:/etc/wireguard

    environment:
      # UI
      - WG_HOST=your.public.ip.or.dns
      - PASSWORD=change-me

      # Optional tuning
      - WG_PORT=51820
      - WG_MTU=1420
      - WG_PERSISTENT_KEEPALIVE=25

    restart: unless-stopped

Why this works (and your error goes away)

• network_mode: host

  • WireGuard must create a real kernel interface (wg0)

  • Host mode avoids Docker NAT entirely

• NET_ADMIN

  • Required for ip link add wg0

• /dev/net/tun

  • Required for tunnel device

• NET_RAW

  • Needed for packet handling (especially on Unraid)

• SYS_MODULE

  • Lets WireGuard load kernel helpers if needed
    (Unraid already has WG, but this avoids edge cases)

mkdir -p /mnt/user/appdata/wireguard

*Docker required the folder pre-made... using unrad defaults!

This will store:

• wg0.conf

• keys

• peer configs
  
  Many ways to accomplish the same thing. as this is why unraid added WireGuard stuff to the host level ...

The extra parameters did the trick. Tank you.

As you have suggested and therefore guessed correctly I am migrating from a Pi running Portainer and docker compose. With that setup it is quite easy to get everything running as I want to but I don't think having a Pi running just wireguard is worth it (also I need the Pi for 39C3).

Don't forget to forward the UDP port of your Wireguard container