Privateerr ⚓¶
Privateerr packages the official, unmodified
pia-foss/manual-connections
scripts into a small Alpine container. It adds repeatable commands, friendly
defaults, a health signal, and a metadata handoff for Docker Compose stacks.
Privateerr is not a VPN client
Privateerr does not establish or maintain a tunnel. It writes a PIA WireGuard configuration file for Gluetun, WireGuard, or another compatible VPN client.
The two outputs¶
| File | Consumer | Purpose |
|---|---|---|
config/gluetun/wireguard/wg0.conf |
Gluetun or another WireGuard client | Interface, peer, keys, and endpoint generated by PIA's scripts. |
config/gluetun/wireguard/privateerr.env |
Gluetun wrapper and automation | Selected server name, endpoint, region, and port-forwarding support. |
The metadata solves an awkward timing problem. When PIA chooses a WireGuard endpoint, Gluetun needs the matching server name to perform PIA port forwarding. Privateerr discovers that relationship before Gluetun starts and records it in a machine-readable file.
Images and platforms¶
Published images are available from GHCR and Docker Hub for linux/amd64,
linux/arm64, and linux/arm/v7.
| Channel | GHCR | Docker Hub |
|---|---|---|
| Stable | ghcr.io/scottgigawatt/privateerr:latest |
scottgigawatt/privateerr:latest |
| Preview | ghcr.io/scottgigawatt/privateerr:edge |
scottgigawatt/privateerr:edge |
Stable semantic-version tags are available when you need an exact release.
Use edge only when intentionally testing the newest successful main build.
Trust boundary¶
- PIA's scripts remain visibly upstream and unmodified in a Git submodule.
- Privateerr-owned scripts wrap those upstream scripts and create metadata.
- The build uses pinned inputs, scans images with Trivy, publishes multi-architecture manifests, and attaches SBOM/provenance information.
wg0.confis secret material even though it is generated rather than typed.