Quick-fix OpenMediaVault, Docker and Wireguard

When running OpenMediaVault (OMV) 6 as a NAS accessible exclusively through a Wireguard VPN, Docker may fail to start with a frustrating error. Here’s how to diagnose and fix this conflict.

The Problem

Docker fails to start with:

docker.socket: Failed with result 'service-start-limit-hit'

Manual service launch returns:

Job for docker.service failed because the control process exited with error code.
See "systemctl status docker.service" and "journalctl -xe" for details.

Context

OpenMediaVault (OMV) is an open-source NAS solution based on Debian. Version 6 uses Linux kernel 6. Its services can be extended through OMV-extras, which leverages Docker containers.

Wireguard is used here to restrict NAS access exclusively through VPN. It operates with firewall rules for the IP range 10.0.0.0/8, which is the source of the conflict.

Analysis

The issue stems from conflicts between IPTables and NFTables configurations. Wireguard’s firewall rules use NFTables, while Docker expects IPTables.

Confirming the Diagnosis

Stopping Wireguard and restarting Docker confirms the conflict:

# Stop Wireguard
sudo service wg-quick@wg0 stop

# Start Docker - it works!
sudo service docker start

# Test Docker
docker run -it ubuntu:latest

However, restarting Wireguard afterward breaks network connectivity:

docker: Error response from daemon: Get "https://registry-1.docker.io/v2/":
dial tcp: lookup registry-1.docker.io on [::1]:53: read udp [::1]:36009->[::1]:53:
read: connection refused.

The Solution

Force Debian to use legacy IPTables instead of NFTables, allowing Docker and Wireguard to coexist:

sudo update-alternatives --set iptables /usr/sbin/iptables-legacy
sudo update-alternatives --set ip6tables /usr/sbin/ip6tables-legacy

Restart both services:

sudo service wg-quick@wg0 start
sudo service docker start

Verify everything works:

docker run -it alpine sh

Expected output:

Unable to find image 'alpine:latest' locally
latest: Pulling from library/alpine
c158987b0551: Pull complete
Digest: sha256:...
Status: Downloaded newer image for alpine:latest
/ #

Docker and Wireguard now coexist without conflict.