Requirements

Software

• An x86_64 or ARM64 processor.
• Linux with WireGuard support.
• Docker with Docker Compose v2.

Note

Most modern home-server platforms ship with everything needed: Unraid, TrueNAS SCALE, Synology DSM 7+, OpenMediaVault, and any recent Debian/Ubuntu/Fedora install all qualify out of the box.

Network

For the best performance you want the WireGuard UDP port reachable from the public internet, so clients connect directly. Either of these gets you there, and atreoLINK derives your public IP from the agent’s authenticated connection, so you never have to configure or track it:

• A router that supports NAT-PMP or UPnP, so the agent maps the port automatically. This covers the vast majority of consumer routers.
• A static UDP port forward on your router (any router can do this). See Manual port forwarding.

Note

Behind CGNAT? It still works. If your ISP puts you behind Carrier-Grade NAT (your public IP starts with 100.64.x.x or 10.x.x.x), no inbound port can reach you — but the agent detects this and automatically falls back to the atreoLINK CGNAT relay, which keeps your server reachable while preserving end-to-end encryption. A direct path is still preferred when you can get one (ask your ISP for a public IP, or use IPv6), so the relay is a fallback rather than the goal.

Docker capabilities

The agent runs WireGuard directly on the host kernel, which needs three Docker features:

Capability	Reason
cap_add: NET_ADMIN	Create and configure the wg-atreo network interface.
devices: /dev/net/tun	TUN device for the userspace fallback (rarely used).
network_mode: host	Let WireGuard bind directly to the host network stack.

Standard requirements for any containerised VPN.

Persistent volume

The agent stores all state (long-term identity keys, pairing pin, TLS certificates, ACL cache, paired-device records) under /var/lib/atreoagent inside the container. The example Compose file bind-mounts this to an agent-data/ directory alongside your docker-compose.yml. Back it up if you want to migrate hardware without re-pairing.

Account

You need an atreoLINK account. The free plan lets you connect one of your own servers and invite one other person, and joining servers you’ve been invited to is always free. Paid plans raise the server and member limits and add custom domains — see pricing for the current tiers.