hbixu/wireguard-proxy
Docker image that establishes a VPN connection through WireGuard and provides SOCKS5/HTTP proxies.
Image
Networking
0
1.5K
hbixu/wireguard-proxy repository overview
WireGuard Proxy
Docker image that connects via WireGuard VPN and exposes SOCKS5 and HTTP/HTTPS proxies; traffic is routed through the VPN only when it is up.
Features
- WireGuard VPN with PostUp/PostDown hooks for proxy lifecycle
- SOCKS5 proxy (go-socks5-proxy) — TCP/UDP via VPN
- HTTP/HTTPS proxy (tinyproxy) — via VPN
- VPN monitoring and auto-restart; proxies stop when VPN drops
- Based on LinuxServer.io baseimage-alpine
Image versions
Base image: ghcr.io/linuxserver/baseimage-alpine. Tags below refer to the base image tag.
| Image tag | Base tag | WireGuard | tinyproxy | go-socks5-proxy |
|---|---|---|---|---|
1.2.0 | 3.23-f954c727-ls8 | wireguard-tools 1.0.20250521-r1, wireguard-go 0.0.20250522-r6 | 1.11.2-r0 | 1.0.0 |
1.1.0 | 3.23-d34fa4d2-ls4 | wireguard-tools 1.0.20250521-r1, wireguard-go 0.0.20250522-r5 | 1.11.2-r0 | 1.0.0 |
1.0.1 | 3.23-d34fa4d2-ls4 | wireguard-tools 1.0.20250521-r1, wireguard-go 0.0.20250522-r4 | 1.11.2-r0 | 1.0.0 |
1.0.0 | 3.23-d34fa4d2-ls4 | wireguard-tools 1.0.20250521-r1, wireguard-go 0.0.20250522-r4 | 1.11.2-r0 | 1.0.0 |
Requirements
- WireGuard config file (
.conf) withPostUp/PostDownpointing to/root/vpn-up.shand/root/vpn-down.sh - Host:
NET_ADMIN,SYS_MODULE,/dev/net/tun; kernel with WireGuard support (or wireguard-go fallback)
Quick start
docker pull wireguard-proxy:1.2.0
mkdir -p configs-wireguard configs-tinyproxy logs
# Place your wg0.conf in configs-wireguard/
docker run -d --name wireguard-proxy \
--cap-add=NET_ADMIN --cap-add=SYS_MODULE --device=/dev/net/tun \
-v $(pwd)/configs-wireguard:/config/wireguard:ro \
-v $(pwd)/configs-tinyproxy:/config/tinyproxy \
-v $(pwd)/logs:/var/log \
-e VPN_CONFIG_FILE=wg0.conf \
-e PUID=1000 -e PGID=1000 \
-p 1080:1080 -p 8080:8080 \
--restart unless-stopped \
wireguard-proxy:1.2.0
Environment variables
| Variable | Required | Description |
|---|---|---|
VPN_CONFIG_FILE | Yes | WireGuard config filename in /config/wireguard/ |
TZ | No | Timezone (default: Europe/Lisbon) |
PUID / PGID | No | Ownership for files (default: 1000) |
PROXY_SOCKS5_PORT / PROXY_HTTP_PORT | No | Proxy ports (default: 1080, 8080) |
PROXY_ALLOWED_NETWORKS | No | Allowed CIDR for proxies (default: private ranges) |
VPN_ENABLED | No | Set to false to run proxy without VPN (default: true) |
See the GitHub repository for the full list.
Example docker-compose
services:
wireguard-proxy:
image: wireguard-proxy:1.2.0
container_name: wireguard-proxy
cap_add:
- NET_ADMIN
- SYS_MODULE
devices:
- /dev/net/tun
volumes:
- ./configs-wireguard:/config/wireguard:ro
- ./configs-tinyproxy:/config/tinyproxy
- ./logs:/var/log
environment:
- VPN_CONFIG_FILE=wg0.conf
- PUID=1000
- PGID=1000
ports:
- "1080:1080"
- "8080:8080"
restart: unless-stopped
healthcheck:
test: ["CMD", "/root/healthcheck.sh"]
interval: 30s
timeout: 10s
start_period: 60s
retries: 3
Full example: docker-compose.yml in the repository.
Ports
| Port | Service |
|---|---|
| 1080 | SOCKS5 proxy |
| 8080 | HTTP/HTTPS proxy (tinyproxy) |
Security note
WireGuard runs as root (required for capabilities and /dev/net/tun). Proxies run as non-root when PUID/PGID are set. See the repository SECURITY.md for details.
Links
- Source: GitHub – hbixu/wireguard-proxy
- Issues: GitHub Issues
- License: LICENSE
Tag summary
Content type
Image
Digest
sha256:cfa5f370b…
Size
19 MB
Last updated
5 months ago
docker pull hbixu/wireguard-proxy