docker-netbird

What the image provides

NetBird combines a WireGuard based overlay network with Zero Trust Network Access to give a unified open source platform for secure connectivity, letting you create your own self hosted ZTNA mesh network. The docker-netbird image runs NetBird from a single image rather than multiple, in a rootless and distroless form for more security and convenience. It supports all NetBird images as one image, with the dashboard needing a custom command entry.

Security and operations

The image runs rootless as user 1000:1000, has no shell because it is distroless, and is auto updated to the latest version through CI/CD. It includes a health check, runs read only, and is scanned for CVEs before and after publishing. The build uses a secure and pinned CI/CD process, and the image is small. It also creates random entries for unset keys and hashes from the default configuration.

Configuration and deployment

The init binary replaces environment variables in the default.yml config file in either the dollar brace or dollar format. The default config can be customized with environment variables, your own file, or an inline config. By default the image uses the embedded identity provider, and you can add Keycloak or another external provider. The project ships its own Helm charts and a Terraform deployment script, and is written in Go.

Editorial conclusion

docker-netbird is written in Go, licensed under MIT, and provides both Helm charts and a Terraform script for deploying the rootless NetBird image.