88 lines
3.7 KiB
Docker
88 lines
3.7 KiB
Docker
|
# syntax=docker/dockerfile:1
|
||
|
|
|
||
|
|
###############################################################################
|
||
|
|
# awg_profiler — container image
|
||
|
|
#
|
||
|
|
# AmneziaWG is NOT packaged in Alpine's repos, and a container cannot load the
|
||
|
|
# kernel module. So the data plane is the userspace implementation
|
||
|
|
# `amneziawg-go`: `awg-quick` automatically falls back to it (via /dev/net/tun)
|
||
|
|
# when /sys/module/amneziawg is absent — exactly the container case.
|
||
|
|
#
|
||
|
|
# Three builder stages compile everything statically, then a tiny Alpine
|
||
|
|
# runtime carries only the finished binaries + a handful of CLI helpers the
|
||
|
|
# tool shells out to (awg / awg-quick / amneziawg-go / nft / qrencode).
|
||
|
|
###############################################################################
|
||
|
|
|
||
|
|
# Pin the versions of the AmneziaWG userspace components for reproducible builds.
|
||
|
|
ARG AWG_TOOLS_REF=master
|
||
|
|
ARG AWG_GO_REF=master
|
||
|
|
|
||
|
|
# ─── Stage 1: build the profiler binary (static, CGO off → runs on musl) ──────
|
||
|
|
FROM golang:1.26-alpine AS app-builder
|
||
|
|
WORKDIR /src
|
||
|
|
# Assets in webui/ are compiled into the binary via //go:embed, so the whole
|
||
|
|
# module source is needed but nothing has to be shipped alongside the binary.
|
||
|
|
COPY go.mod ./
|
||
|
|
COPY *.go ./
|
||
|
|
COPY webui/ ./webui/
|
||
|
|
COPY webui_glass/ ./webui_glass/
|
||
|
|
ENV CGO_ENABLED=0
|
||
|
|
RUN go build -trimpath -ldflags="-s -w" -o /out/awg_profiler .
|
||
|
|
|
||
|
|
# ─── Stage 2: build amneziawg-go (userspace WireGuard/AmneziaWG data plane) ───
|
||
|
|
FROM golang:1.26-alpine AS awggo-builder
|
||
|
|
ARG AWG_GO_REF
|
||
|
|
RUN apk add --no-cache git make
|
||
|
|
WORKDIR /src
|
||
|
|
RUN git clone --depth=1 --branch "${AWG_GO_REF}" \
|
||
|
|
https://github.com/amnezia-vpn/amneziawg-go . \
|
||
|
|
&& CGO_ENABLED=0 make \
|
||
|
|
&& install -Dm0755 amneziawg-go /out/amneziawg-go
|
||
|
|
|
||
|
|
# ─── Stage 3: build amneziawg-tools (the `awg` + `awg-quick` C tools) ─────────
|
||
|
|
FROM alpine:3.20 AS tools-builder
|
||
|
|
ARG AWG_TOOLS_REF
|
||
|
|
RUN apk add --no-cache git build-base linux-headers bash
|
||
|
|
WORKDIR /src
|
||
|
|
RUN git clone --depth=1 --branch "${AWG_TOOLS_REF}" \
|
||
|
|
https://github.com/amnezia-vpn/amneziawg-tools . \
|
||
|
|
&& make -C src \
|
||
|
|
&& make -C src install \
|
||
|
|
WITH_WGQUICK=yes WITH_BASHCOMPLETION=no WITH_SYSTEMDUNITS=no \
|
||
|
|
DESTDIR=/out PREFIX=/usr
|
||
|
|
|
||
|
|
# ─── Stage 4: runtime ─────────────────────────────────────────────────────────
|
||
|
|
FROM alpine:3.20
|
||
|
|
|
||
|
|
# awg-quick is a bash script and drives `ip` (iproute2); the profiler shells out
|
||
|
|
# to nft (firewall/NAT rules) and qrencode (client QR codes). ca-certificates is
|
||
|
|
# needed for the public-IP HTTPS lookup. Everything else it needs (sysctl, grep,
|
||
|
|
# mktemp, …) is already provided by busybox.
|
||
|
|
RUN apk add --no-cache \
|
||
|
|
bash \
|
||
|
|
iproute2 \
|
||
|
|
nftables \
|
||
|
|
libqrencode-tools \
|
||
|
|
ca-certificates
|
||
|
|
|
||
|
|
# AmneziaWG userspace stack + the profiler itself.
|
||
|
|
COPY --from=tools-builder /out/usr/ /usr/
|
||
|
|
COPY --from=awggo-builder /out/amneziawg-go /usr/bin/amneziawg-go
|
||
|
|
COPY --from=app-builder /out/awg_profiler /usr/local/bin/awg_profiler
|
||
|
|
COPY entrypoint.sh /usr/local/bin/entrypoint.sh
|
||
|
|
RUN chmod +x /usr/local/bin/entrypoint.sh
|
||
|
|
|
||
|
|
# All mutable profiler state (config, client registry, generated profiles, the
|
||
|
|
# deps-installed flag) lives here; the interface .conf + nft ruleset live in
|
||
|
|
# /etc/amnezia/amneziawg. Mount volumes on both to persist across restarts.
|
||
|
|
ENV AWG_PROFILER_DIR=/data
|
||
|
|
VOLUME ["/data", "/etc/amnezia/amneziawg"]
|
||
|
|
|
||
|
|
# WireGuard/AmneziaWG listen port (UDP) and the management web UI (TCP).
|
||
|
|
EXPOSE 51820/udp
|
||
|
|
EXPOSE 8080/tcp
|
||
|
|
|
||
|
|
ENTRYPOINT ["/usr/local/bin/entrypoint.sh"]
|
||
|
|
# Default to the web UI on all interfaces; override with any profiler subcommand.
|
||
|
|
CMD ["web", "--addr", "0.0.0.0:8080"]
|