What is warp-docker?

warp-docker runs the official Cloudflare WARP VPN client inside a Docker container. It exposes a SOCKS5 and HTTP proxy on port 1080 via GOST so other containers or the host can send traffic through Cloudflare's network. It supports WARP+ license keys, Cloudflare Zero Trust enrollment, MASQUE protocol, and can also operate as a NAT gateway for layer-3 traffic routing. The image is published on Docker Hub as caomingjun/warp with versioned tags matching WARP and GOST releases, plus a slim Debian variant. Configuration is done via environment variables for sleep time, license key, GOST arguments, NAT mode, and host connectivity fixes. The project is licensed under GPL-3.0 and actively maintained.

Should you self-host warp-docker?

warp-docker scores 57/100 on selfhost.directory (how scoring works) and ranks #24 of 56 in VPN. It has 1 053 GitHub stars.

There was no stable release in the past 12 months, so check the repository's recent activity before you rely on it.

Setup is moderate: expect some configuration beyond a single command. An official Docker image is available. It is GPL-3.0-licensed and written mostly in Shell.

Its closest alternative on selfhost.directory is Tailscale (84/100, 38 203 stars). It scores higher overall, so compare the two before you pick. See warp-docker vs Tailscale side by side.

Features

Data Persistence
Health Checks
MASQUE Protocol
NAT Gateway Mode
Podman support
Slim VariantExperimental, use at own risk.
SOCKS5/HTTP Proxy
WARP ConnectorDocumentation notes this may be out of date due to Cloudflare changes.
WARP+ Support

How to install warp-docker

Install warp-docker with Docker

Docker with NET_ADMIN capability, /dev/net/tun access

Environment variables

WARP_SLEEP, WARP_LICENSE_KEY, GOST_ARGS, REGISTER_WHEN_MDM_EXISTS, BETA_FIX_HOST_CONNECTIVITY, WARP_ENABLE_NAT

docker run -d
--name warp
--restart always
-p 1080:1080
-e WARP_SLEEP=2
--cap-add=NET_ADMIN
--device=/dev/net/tun
--sysctl net.ipv6.conf.all.disable_ipv6=0
--sysctl net.ipv4.conf.all.src_valid_mark=1
-v ./data:/var/lib/cloudflare-warp
docker.io/caomingjun/warp:latest

Example from Podman docs, works with Docker too.

Install warp-docker with Docker Compose

Docker with NET_ADMIN capability, /dev/net/tun access

Environment variables

WARP_SLEEP, WARP_LICENSE_KEY, GOST_ARGS, REGISTER_WHEN_MDM_EXISTS, BETA_FIX_HOST_CONNECTIVITY, WARP_ENABLE_NAT

version: "3"

services: warp: image: caomingjun/warp container_name: warp restart: always # add removed rule back (https://github.com/opencontainers/runc/pull/3468) device_cgroup_rules: - 'c 10:200 rwm' ports: - "1080:1080" environment: - WARP_SLEEP=2 # - WARP_LICENSE_KEY= # optional # - WARP_ENABLE_NAT=1 # enable nat cap_add: # Docker already have them, these are for podman users - MKNOD - AUDIT_WRITE # additional required cap for warp, both for podman and docker - NET_ADMIN sysctls: - net.ipv6.conf.all.disable_ipv6=0 - net.ipv4.conf.all.src_valid_mark=1 # uncomment for nat # - net.ipv4.ip_forward=1 # - net.ipv6.conf.all.forwarding=1 # - net.ipv6.conf.all.accept_ra=2 volumes: - ./data:/var/lib/cloudflare-warp

Requires NET_ADMIN capability and device_cgroup_rules for /dev/net/tun access.

Install warp-docker with Podman

Podman with NET_ADMIN capability, /dev/net/tun access

Environment variables

WARP_SLEEP, WARP_LICENSE_KEY, GOST_ARGS, REGISTER_WHEN_MDM_EXISTS, BETA_FIX_HOST_CONNECTIVITY, WARP_ENABLE_NAT

podman run -d
--name warp
--restart always
-p 1080:1080
-e WARP_SLEEP=2
--cap-add=NET_ADMIN
--device=/dev/net/tun
--sysctl net.ipv6.conf.all.disable_ipv6=0
--sysctl net.ipv4.conf.all.src_valid_mark=1
-v ./data:/var/lib/cloudflare-warp
docker.io/caomingjun/warp:latest

Rootless Podman may need /dev/tun mounted; example from community contributor.