Wireguard docker-compose loop problem

I can only make a wireguard docker if I add the line network_mode: bridge to docker-compose.yml

If I try to make a wireguard docker without that line I get an error:

wireguard | [FATAL] plugin/loop: Loop (127.0.0.1:50437 → :53) detected for zone “.”, see loop. Query: “HINFO 500036817.976505179.”
wireguard | Another service is using port 53, disabling CoreDNS

This means that a wireguard docker can only connect to an existing network (bridge) on which there are already portainer and yacht dockers and cannot connect it to its separate bridge network without errors.

My yml:

version: “2.1”
services:
wireguard:
image: linuxserver/wireguard:arm32v7-latest
container_name: wireguard
network_mode: bridge
cap_add:
- NET_ADMIN
- SYS_MODULE
environment:
- VERSION=latest
- PUID=0
- PGID=0
- TZ=Europe/Wien
- SERVERURL=myip
- SERVERPORT=51820
- PEERS=1
- PEERDNS=8.8.8.8
- ALLOWEDIPS=10.13.13.1/32, 192.168.1.0/24
volumes:
- /sharedfolders/docker/wireguard/config:/config
- /lib/modules:/lib/modules
- /usr/src:/usr/src
ports:
- 51820:51820/udp
sysctls:
- net.ipv4.conf.all.src_valid_mark=1
restart: unless-stopped

Hardware:
Odroid HC2 (with OMV5 on Armbian)

network_mode: bridge is the default, if you don’t put anything, that’s what is used. Are you using portainer to deploy this or docker-compose?

I use docker-compose.
If I do not put network_mode: bridge to docker-compose.yml then wireguard docker create another bridge (i think that is wireguard_default bridge) but then I have this “loop” error.

I used your compose, using proper PUID/PGID since we don’t support using 0, and on x86_64 because i dont have an arm unit to test on and it worked… we might need the expert @aptalca to chime in, it’s very odd for sure.

what’s your docker-compose version and docker version? docker-compose -v && docker -v

~# docker-compose -v && docker -v
docker-compose version 1.28.4, build cabd5cfb
Docker version 20.10.10, build b485636

can you also provide /etc/resolv.conf from the host as well as the container docker exec -it wireguard cat /etc/resolv.conf

saw you popped in, thanks for providing that!

~# docker exec -it wireguard cat /etc/resolv.conf

# This file is managed by man:systemd-resolved(8). Do not edit.
#
# This is a dynamic resolv.conf file for connecting local clients directly to
# all known uplink DNS servers. This file lists all configured search domains.
#
# Third party programs must not access this file directly, but only through the
# symlink at /etc/resolv.conf. To manage man:resolv.conf(5)in a different way,
# replace this symlink by a static file or a different symlink.
#
# See man:systemd-resolved.service(8) for details about the supported modes of
# operation for /etc/resolv.conf.

nameserver 8.8.8.8
nameserver 8.8.4.4

host as well please (we are thinking it’s going to be localhost)

# This file is auto-generated by openmediavault (https://www.openmediavault.org)
# WARNING: Do not edit this file, your changes will get lost.
127.0.0.1 localhost.localdomain localhost
127.0.1.1 odroidHC2 
# The following lines are desirable for IPv6 capable hosts.
::1     ip6-localhost ip6-loopback
fe00::0 ip6-localnet
ff00::0 ip6-mcastprefix
ff02::1 ip6-allnodes
ff02::2 ip6-allrouters
ff02::3 ip6-allhosts
192.168.1.66		odroidHC2

sorry i meant /etc/resolv.conf from the host, not /etc/hosts :smiley:

# This file is managed by man:systemd-resolved(8). Do not edit.
#
# This is a dynamic resolv.conf file for connecting local clients directly to
# all known uplink DNS servers. This file lists all configured search domains.
#
# Third party programs must not access this file directly, but only through the
# symlink at /etc/resolv.conf. To manage man:resolv.conf(5) in a different way,
# replace this symlink by a static file or a different symlink.
#
# See man:systemd-resolved.service(8) for details about the supported modes of
# operation for /etc/resolv.conf.

nameserver 8.8.8.8
nameserver 8.8.4.4

OK, we are back to the drawing board; i have to take off to pick kids up. It may be best to stop by our discord!

:+1:

With my yml wireguard is working and I can connect my android phone with NAS where is wireguard docker installed and I can connect all services on NAS but I can not connect to any other devices on my LAN

That is a config or host issue, let’s focus on the loop for this forum topic. For config support on wireguard (ie, reaching your full lan) discord is your best bet for quick resolution.

Installing wireguard “outside docker” resolve all my problems.
Solution for me is not to use wireguard docker.