WireGuard 0.0.20250522

Ubuntu 24.04 · Built from upstream's source

Free image

Docker Hub
docker pull readystack/wireguard:0.0.20250522-CE-ubuntu24.04-r1
# check it is ours before you run it
cosign verify --key https://readystack.dev/keys/cosign.pub \
  readystack/wireguard:0.0.20250522-CE-ubuntu24.04-r1
This release on Docker Hub

Hermetic Build Kit

Free with a verified email

The build kit for this exact release: its pinned base images, source, packages and toolchain, not a copy of the published image. Rebuild, verify and operate it offline, with handbooks checked against the image, seed data, the security report and the defect record.

Free with a verified email. Donations are optional ($10 by card, or any amount in crypto). A donation gets you the kit without an account.

Get build kit SLSA provenance on your own builder

Grade

ReadyStack's own scan, daily
Original grade
A · 100
pushed and scanned 2026-10-29
How it was scored
  • High vulnerabilities with no fix yet: 1 × −3 = −3
  • +10 Runs as a non-root user (wireguard)
  • +10 Pushed in the last 90 days
  • +5 Signed (cosign)
  • +5 SLSA build provenance attached
  • +5 Provenance names this exact image
  • +3 HEALTHCHECK defined
  • +3 Standard OCI labels (4 or more)
  • +0 Built for several architectures
  • +3 SBOM attached
  • +2 Docker Hub README shows how to run it

100 +43 = 143, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40.

Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-29T06:23:34Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).

Current grade
A · 100
scanned 2026-10-29C 0 · H 1 · M 66
How it was scored
  • High vulnerabilities with no fix yet: 1 × −3 = −3
  • +10 Runs as a non-root user (wireguard)
  • +10 Pushed in the last 90 days
  • +5 Signed (cosign)
  • +5 SLSA build provenance attached
  • +5 Provenance names this exact image
  • +3 HEALTHCHECK defined
  • +3 Standard OCI labels (4 or more)
  • +0 Built for several architectures
  • +3 SBOM attached
  • +2 Docker Hub README shows how to run it

100 +43 = 143, held to 100 (scores run 0–100). A from 85, B from 70, C from 55, D from 40.

Scanned with syft 1.54.1, grype 0.120.1, vulnerability DB v6.1.10@2026-10-29T06:23:34Z, scored with the cerodeo-v1 rubric, ce.rodeo's until 2026-10-26 (ce.rodeo now scores with cerodeo-v2, which grades most of our releases lower).

A syft SBOM and grype vulnerability matches, scored with cerodeo-v1, the rubric ce.rodeo published until 2026-10-26. The original grade is the first recorded scan of this release, the current grade the latest. All products

This release

As JSON
  • Release tag0.0.20250522-CE-ubuntu24.04-r1
  • Pushed to Docker Hub2026-10-29
  • linux/amd64 digestsha256:9a7cde50fe6f16cea9aeff4714ccb5a115d3b12b37c8df39bd11035fd2afdda9
  • Offline rebuildRebuilt bit-for-bit on 2026-10-28 with the network off
  • SignatureSigned (key 04daa92344a52dbc)
  • Runs asNon-root (wireguard)
  • AttestationsSBOM (SPDX) and SLSA provenance v1
  • Start command adds--cap-add --device
    WireGuard is a network interface: creating it on the TUN device, setting its addresses and routes and bringing it up are network administration (NET_ADMIN), and the userspace implementation (wireguard-go; a container cannot load the kernel module) needs /dev/net/tun. The process runs as the unprivileged user wireguard with that one capability, raised as an ambient capability only when the container is granted it. The non-root rule
  • Defects99 found in review, fixed before release

Who installs it and why

About WireGuard itself, not this release
  • WhoNetwork administrators and individuals who need a simple, secure VPN between servers, sites or devices.
  • WhyWireGuard is a simple, modern VPN that uses current cryptography. Peers authenticate each other by exchanging public keys, much like SSH keys, and the tunnel can roam between IP addresses.
  • Use caseA small company needs staff laptops to reach servers on its office network. A WireGuard endpoint at the office holds each laptop's public key and allowed addresses; each laptop connects with a short configuration file, and the tunnel keeps working as the laptop moves between networks.

Written from the project's own description: www.wireguard.com, git.zx2c4.com/wireguard-go/about. Checked against them on 2026-10-29.