WireGuard

WireGuard is a VPN protocol and a small, in-kernel Linux implementation of it, built around modern cryptographic primitives instead of the sprawling standards stack behind IPsec or OpenVPN. It ships as a kernel module plus two command-line tools, wg and wg-quick: no official app, no account, no coordination service to sign into. The whole thing runs on an idea called cryptokey routing: a public key is a routing table entry, and any packet that decrypts correctly against a peer’s key is allowed onto the tunnel interface, no negotiation handshake and no certificate authority involved. That’s the entire trust model, refreshingly boring compared to everything else in networking, and also why WireGuard ended up underneath so many other self-hosted VPN tools, including Tailscale.

Why self-host it instead of a commercial VPN

A commercial VPN app hides your traffic from your ISP and relocates you on the map, a different job from what most homelabbers want: a private path back into their own network from a laptop at a coffee shop or a phone off wifi. WireGuard handles exactly that, point-to-point tunnels between machines you control, no third-party server relaying anything in between. It doesn’t coordinate devices on its own, though: Tailscale wraps WireGuard in automatic key-exchange and NAT traversal so devices find each other with zero configuration, while raw WireGuard gets the same encryption without it. Our Jellyfin remote access guide covers reaching a home media server safely from outside the house either way.

No official Docker image: the credible community options

WireGuard the project doesn’t publish a Docker image, and it’s unlikely to: it’s a kernel module and CLI tools, not an application with a server process to containerize. Every “WireGuard Docker image” out there is a third party wrapping wg-quick and a config generator around the same kernel primitives, so the image you pick matters more than usual.

Two options stand out. wg-easy pairs a WireGuard server with a full web UI to add and remove peers, scan QR codes, and watch per-client traffic. It’s AGPL-3.0 licensed, explicitly unaffiliated with the WireGuard project (a disclaimer the maintainers state in their own README), and actively maintained: v15.2.2 shipped February 2026, with more than 25,000 GitHub stars. linuxserver/wireguard, 3,600 stars and a June 2026 release, is the CLI-only alternative: no web UI, peer configs and QR codes written to the container log via a PEERS variable instead. Both still depend on the host having WireGuard kernel support.

Setting up WireGuard with Docker

This is wg-easy’s own docker-compose.yml, trimmed to what a first setup needs. The full file on GitHub also pins the container to a static IP on a custom bridge network, useful for advanced routing but not required here.

volumes:
  etc_wireguard:

services:
  wg-easy:
    image: ghcr.io/wg-easy/wg-easy:15
    container_name: wg-easy
    volumes:
      - etc_wireguard:/etc/wireguard
      - /lib/modules:/lib/modules:ro
    ports:
      - "51820:51820/udp"
      - "51821:51821/tcp"
    restart: unless-stopped
    cap_add:
      - NET_ADMIN
      - SYS_MODULE
    sysctls:
      - net.ipv4.ip_forward=1
      - net.ipv4.conf.all.src_valid_mark=1

1. Install Docker if it isn’t already there, save the file above as docker-compose.yml, and run docker compose up -d.
2. Forward UDP 51820 on your router to this host, the only port that needs to reach the open internet.
3. Open port 51821 in a browser and complete the first-run setup: an admin password and the hostname or IP clients will connect to.
4. Add a client from the web UI, then scan its QR code with the WireGuard app on a phone, or download the .conf file for a desktop.

docker compose up -d
docker compose logs -f wg-easy

Basic configuration: keys and peers

wg-easy and linuxserver/wireguard both generate files that follow the same format under the hood, the one wg-quick reads directly:

[Interface]
PrivateKey = <server private key>
Address = 10.8.0.1/24
ListenPort = 51820

[Peer]
PublicKey = <client public key>
AllowedIPs = 10.8.0.2/32

wg-easy just spares you from running wg genkey and wg pubkey by hand and pasting the results into two matching files. Every peer needs the server’s public key, and every peer’s AllowedIPs has to be unique and non-overlapping, or routing breaks silently instead of throwing an error.

WireGuard vs Tailscale vs OpenVPN

	WireGuard (raw)	Tailscale	OpenVPN
Coordination	None, you configure every peer	Automatic, via Tailscale’s server	None, you configure every peer
Setup effort	Keys and AllowedIPs by hand, or via wg-easy	Install and log in, a few minutes	Certificates and TLS config, more moving parts
NAT traversal	Manual, needs a public IP or a forwarded port	Automatic in most conditions	Manual, same constraint as WireGuard
Best fit	Full control, no third party	Zero-config mesh across many devices	Legacy compatibility only

• Minimal, auditable codebase running at kernel level, genuinely fast
• No coordination server and no account; nobody but you ever holds a key
• Silent to unauthenticated scans, doesn’t respond unless the crypto matches

• No official Docker image; you’re trusting a community maintainer’s build
• No built-in NAT traversal or dynamic DNS, needs a public IP or a forwarded port
• Every peer is manual, no automatic key rotation or central device list

Remote access to a home media server is one of the most common reasons homelabbers reach for a VPN in the first place. Our Jellyfin remote access guide walks through doing exactly that, with either WireGuard directly or Tailscale on top of it.

FAQ

Is WireGuard open source?

Yes. The Linux kernel module and the wireguard-tools CLI are GPLv2, and wireguard-go, the userspace implementation used off Linux and inside many containers, is MIT. There’s no closed-source WireGuard component at all, unlike Tailscale’s coordination server.

Is there an official WireGuard Docker image?

No. The WireGuard project ships a kernel module and command-line tools, not a container. wg-easy and linuxserver/wireguard are both community-maintained and explicitly unaffiliated with the WireGuard project.

Is WireGuard faster than OpenVPN?

In most benchmarks, yes, partly because it runs in the kernel and partly because its cryptographic primitives are cheaper to compute. The gap is most noticeable on lower-power hardware like a Raspberry Pi, where OpenVPN’s larger codebase and userspace overhead cost more.

For most homelabs, WireGuard behind wg-easy is the simplest fully self-hosted VPN available: fast, auditable, and entirely under your own keys. Reach for Tailscale instead when the automation matters more than owning every layer yourself. Our homelab setup guide for beginners and Jellyfin remote access guide cover what to run it on and what to do with it next.