← Directory

PIA WireGuard

A Docker container for setting up Private Internet Access (PIA) WireGuard connectivity and exporting the client configuration file to a directory, useful for…

  • Network Services
  • Tools & Utilities
A Docker container for setting up Private Internet Access (PIA) WireGuard connectivity and exporting the client configuration file to a directory, useful for homelab users who want a simple PIA WireGuard setup.

Platform availability

Available on 1 of 9 platforms

  • Unraid
  • TrueNAS (not listed)
  • Umbrel (not listed)
  • ZimaOS (not listed)
  • Proxmox (not listed)
  • Helm (not listed)
  • Mac (not listed)
  • Windows (not listed)
  • Linux (not listed)

Health score?A 0-100 score computed nightly from four factors: maintained (40%: recent commits and steady activity), popular (25%: GitHub stars, log scale), easy to install (20%: platforms, install notes, setup guides, Docker image) and light to run (15%: minimum RAM, ARM support). When the source code has been checked, a fifth factor, security check (20%: automated scan for committed secrets, unsafe desktop-app settings, known-vulnerable dependencies and project hygiene; any serious finding caps it at 20), is added. Factors without data are left out and the rest are rescaled.

63/100 Good

Maintained
84last commit 16 days ago
Popular
53446 GitHub stars
Easy to install
351 install platform, install notes, Docker image
Light to run
No data

Based on 3 of 4 factors.

Availability: platform listings confirmed today, links checked 13 days ago

GitHub stars
446
Open issues
51
Last commit
2026-09-27
Activity
steady

Checked 6 days ago - source: GitHub (thrnz/docker-wireguard-pia)

Resources & Compatibility

ARM (e.g. Raspberry Pi) is supported.

Checked 14 days ago - source: Docker Hub image tags and published docs

First-install notes

  • Replace the install placeholders Open PowerShell (the Windows command window) and replace <clientid> and <partnername> with your real values before running the PIA Agent install command, because placeholder text stops the agent from joining your PIA account or client. source
  • Clear the old agent certificate Use the -clearcert option in the example so the installer removes any old certificate (the security key the agent uses to prove its identity) before setup, because an outdated key can keep it from authenticating to PIA. source
  • Kernel and capability requirements Grant the container NET_ADMIN, ensure the host kernel supports WireGuard or /dev/net/tun, and provide an active Private Internet Access subscription. source

Fetched 5 days ago - each note links to its source

Alternatives

No alternatives collected yet.

Common questions

Do I need special Docker capabilities?

The container requires NET_ADMIN. SYS_MODULE may also be needed if the host uses a kernel module for WireGuard.

How do I expose my local network through the PIA tunnel?

Set LOCAL_NETWORK to the LAN ranges you want to route. If it is not set, LAN access is unavailable.

How do I handle a PIA location that fails during startup?

Provide multiple LOC values separated by spaces or commas. They are used as fallbacks if the initial endpoint registration fails.

How do I keep inbound traffic working behind NAT?

Set KEEPALIVE, for example to 25, so idle links do not drop incoming packets.

Can I connect a qBittorrent container to the same PIA network?

Yes, attach another container with network_mode to the same network and add a dependency on the PIA container.

Answers sourced from github.com, www.reddit.com

Community

Collected 14 days ago - public community threads