From 55773e92ce93992805dc57271a64d8fbf5d21d15 Mon Sep 17 00:00:00 2001 From: Pasha Sviderski Date: Tue, 8 Jul 2025 21:20:49 +1000 Subject: [PATCH] fix: allow direct routing from WireGuard mesh to containers for Docker 28.2.0+ --- internal/machine/docker/manager_linux.go | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/internal/machine/docker/manager_linux.go b/internal/machine/docker/manager_linux.go index cbd7b067..8c38bca4 100644 --- a/internal/machine/docker/manager_linux.go +++ b/internal/machine/docker/manager_linux.go @@ -13,6 +13,7 @@ import ( "github.com/psviderski/uncloud/internal/machine/dns" "github.com/psviderski/uncloud/internal/machine/firewall" "github.com/psviderski/uncloud/internal/machine/network" + "github.com/psviderski/uncloud/pkg/api" ) // EnsureUncloudNetwork creates the Docker bridge network NetworkName with the provided machine subnet @@ -52,6 +53,14 @@ func (m *Manager) EnsureUncloudNetwork(ctx context.Context, subnet netip.Prefix, }, }, }, + Labels: map[string]string{ + api.LabelManaged: "", + }, + Options: map[string]string{ + // Starting with Docker 28.2.0 (https://github.com/moby/moby/pull/49832), we have to explicitly + // allow direct routing from the WireGuard interface to the bridge network. + "com.docker.network.bridge.trusted_host_interfaces": network.WireGuardInterfaceName, + }, }, ); err != nil { return fmt.Errorf("create Docker network '%s': %w", NetworkName, err)