losenmann/bypass-aio repository overview

FROM alpine:3.23.3 AS configs
WORKDIR /tmp/out-stage
RUN install -m 755 -o 5050 -g 5050 -Dd ./var/log/sockd
RUN install -m 755 /dev/stdin -D ./entrypoint.sh <<-EOF
        #!/bin/bash
        resolvconf -u && awg-quick up wg0; sleep 3
        nft -f /etc/nftables.d/bypass.nft
        sockd -f /etc/sockd.conf -D
        telemt /etc/telemt/config.toml
EOF
RUN install -m 755 /dev/stdin -D ./etc/nftables.d/bypass.nft <<-EOF
        #!/usr/sbin/nft -f

        table ip nat {
            chain POSTROUTING {
                type nat hook postrouting priority srcnat; policy accept;
                oifname "wg0" counter masquerade
            }
        }

        table ip mangle {
            chain POSTROUTING {
                type filter hook postrouting priority mangle; policy accept;
                ip protocol udp meta mark 0x0000ca6c counter comment "CONNMARK"
            }

            chain PREROUTING {
                type filter hook prerouting priority mangle; policy accept;
                ip protocol udp counter comment "CONNMARK"
            }
        }
EOF

FROM alpine:3.23.4 AS merge
WORKDIR /tmp/out-stage
COPY --from=losenmann/awg:0.2.17 --chmod=0755 /usr/bin/amneziawg-go /usr/bin/awg /usr/bin/awg-quick ./usr/bin/
COPY --from=losenmann/telemt:3.4.6 --chmod=0755 /usr/bin/telemt ./usr/bin/
COPY --from=losenmann/dante:1.4.4 /etc/pam_radius_auth.conf /etc/sockd.conf ./etc/
COPY --from=losenmann/dante:1.4.4 --chmod=0755 /usr/lib/security/pam_radius_auth.so ./usr/lib/security/pam_radius_auth.so
COPY --from=losenmann/dante:1.4.4 /etc/pam.d/sockd ./etc/pam.d/sockd
COPY --from=losenmann/dante:1.4.4 --chmod=0755 /usr/sbin/sockd ./usr/sbin/sockd
COPY --from=configs /tmp/out-stage ./

## Main app
FROM alpine:3.23.4 AS app
WORKDIR /opt/app
RUN apk add --no-cache \
        bash \
        iproute2 \
        nftables \
        openresolv \
        linux-pam \
        libtirpc \
        curl \
    && addgroup -g 1000 sockd \
    && adduser -D -G sockd -u 1000 -s /bin/sh sockd
COPY --from=merge /tmp/out-stage /
EXPOSE 1080/tcp 443/tcp
ENTRYPOINT ["/entrypoint.sh"]