[FEAT] Always-OnKill Switch in Client-mode about docker-wireguard HOT 3 CLOSED

Thanks for opening your first issue here! Be sure to follow the relevant issue templates, or risk having this issue marked as invalid.

from docker-wireguard.

This isn't something we will promote, address, or even mention. Doing so would bring a whole lot of liability to us and likely create a false sense of security for the user.

Leakage depends on how the configs are set up. For client mode, we don't even provide any configs, the user has to create their own.

There are many different ways to tackle the leakage issue and almost all of them depend on the user's specific config and requires personal customizations. There is no one standardized solution.

With that said, wireguard is stateless and as long as there is a valid config, the tunnel will come up, regardless of whether the other side is really connected or not. Plus, if the config is not valid and the tunnel fails, the container deletes the default route, killing network connectivity for the container.

The period where there is leakage by default is while the container is starting up. That part requires custom solutions, or you can make sure wireguard is up and running before other services are up and don't rely on unattended upgrades and such (you should never do that anyway for other reasons).

from docker-wireguard.

I think the "delete the default route" achieves what I was looking for anyway.

from docker-wireguard.