al2-wireguard: Add new container build

3 files changed, 99 insertions, 0 deletions

diff --git a/al2-wireguard/Dockerfile b/al2-wireguard/Dockerfile
new file mode 100644
index 0000000..ca76f37
--- /dev/null
+++ b/al2-wireguard/Dockerfile
@@ -0,0 +1,56 @@
+FROM amazonlinux:2 AS builder
+LABEL maintainer="Mike Crute <mike@crute.us>"
+
+ARG VERSION
+ARG REGION
+
+RUN set -euxo pipefail; \
+    echo "${REGION}" > /etc/yum/vars/awsregion; \
+    amazon-linux-extras install -y kernel-ng; \
+    yum install -y \
+        libmnl-devel \
+        libmnl-static \
+        glibc-static \
+        elfutils-libelf-devel \
+        kernel-devel \
+        pkgconfig \
+        "@Development Tools" \
+    ; \
+    curl -Ls https://git.zx2c4.com/WireGuard/snapshot/WireGuard-${VERSION}.tar.xz | tar -xJC /usr/src; \
+    cd /usr/src/WireGuard-${VERSION}/src; \
+    \
+    make module; \
+    make LDFLAGS="-static" tools
+
+
+FROM amazonlinux:2
+LABEL maintainer="Mike Crute <mike@crute.us>"
+
+ARG VERSION
+
+COPY --from=builder /usr/src/WireGuard-${VERSION}/ /tmp/WireGuard-${VERSION}/
+
+RUN set -euxo pipefail; \
+    yum install -y kmod; \
+    \
+    mkdir -p /opt/wireguard; \
+    cp /tmp/WireGuard-${VERSION}/src/wireguard.ko /opt/wireguard; \
+    \
+    cd /tmp/WireGuard-${VERSION}/src; \
+    \
+    install -v -d "/usr/bin"; \
+    install -v -d "/usr/share/man/man8"; \
+    install -v -m 0755 tools/wg "/usr/bin/wg"; \
+    install -v -m 0644 tools/man/wg.8 "/usr/share/man/man8/wg.8"; \
+    \
+    install -v -m 0700 -d "/etc/wireguard"; \
+    install -v -m 0755 tools/wg-quick/linux.bash "/usr/bin/wg-quick"; \
+    install -v -m 0644 tools/man/wg-quick.8 "/usr/share/man/man8/wg-quick.8"; \
+    \
+    yum clean all; \
+    rm -rf /tmp/WireGuard-${VERSION} /var/cache/yum
+
+ADD entrypoint.sh /
+
+ENTRYPOINT [ "/entrypoint.sh" ]
+CMD [ "sleep", "infinity" ]
diff --git a/al2-wireguard/Makefile b/al2-wireguard/Makefile
new file mode 100644
index 0000000..35797dc
--- /dev/null
+++ b/al2-wireguard/Makefile
@@ -0,0 +1,25 @@
+WG_VERSION=5.12.42-1e9446c323
+FULL_VERSION="$(shell uname -r)-wg-$(WG_VERSION)"
+IMAGE=docker.crute.me/al2-wireguard:$(FULL_VERSION)
+LATEST=$(subst :$(FULL_VERSION),,$(IMAGE)):latest
+REGION="us-west-2"
+
+all:
+        docker pull amazonlinux:2
+        docker build \
+                --build-arg=VERSION=$(WG_VERSION) \
+                --build-arg=REGION=$(REGION) \
+                -t $(IMAGE) .
+
+all-no-cache:
+        docker pull amazonlinux:2
+        docker build \
+                --no-cache \
+                --build-arg=VERSION=$(WG_VERSION) \
+                --build-arg=REGION=$(REGION) \
+                -t $(IMAGE) .
+
+publish:
+        docker push $(IMAGE)
+        docker tag $(IMAGE) $(LATEST)
+        docker push $(LATEST)
diff --git a/al2-wireguard/entrypoint.sh b/al2-wireguard/entrypoint.sh
new file mode 100755
index 0000000..93f59de
--- /dev/null
+++ b/al2-wireguard/entrypoint.sh
@@ -0,0 +1,18 @@
+#!/bin/sh
+
+# This needs the SYS_MODULES and NET_ADMIN capabilities
+#
+# /etc/wireguard should be mounted and include wg-quick configs
+#
+# /lib/modules/$(uname -r) should be mounted to same in container
+
+modprobe ip6_udp_tunnel
+modprobe udp_tunnel
+
+insmod /opt/wireguard/wireguard.ko
+
+for i in /etc/wireguard/*; do
+    wg-quick up "$(basename ${i/.conf/})"
+done
+
+exec "$@"