[BUG] Server mode + host networking + read only = stale wg0 iface, deletes host route on failure

Start by tracing the service run script and finish script around the wg-quick failure path, especially the ip route del default cleanup and the stale wg0 interface. Reproduce with network_mode: host, server mode, and read-only mode, then verify that a failed restart leaves neither a host default-route change nor an undeleted wg0 interface.

Is there an existing issue for this?

• I have searched the existing issues

Current Behavior

In server mode with network_mode: host and in read-only mode, if wg-quick up fails to bring a tunnel up, the service run script executes ip route del default. Because the container shares the host network namespace, this delete's the HOST's default route, knocking it (and any LAN it routes for) offline except via v6.

This is furthermore self-fulfilling: for some reason the original wg0 iface is always left behind on restart, so every subsequent start-up fails unless the user intervenes by manually deleting the stale wg0. The finish script does not clean it up.

Expected Behavior

A container should never delete the host's default route. ip route del default is a client leak-guard that should be absent from server mode and/or scoped to routes that the container itself created.

The interface wg0 should be cleaned up automatically.

Steps To Reproduce

1. Run the container in server mode with network_mode: host and read_only: true on a host whose default route is externally managed, e.g., via DHCP.
2. Run docker restart <container_name>

The default route will be gone, but the wg0 interface left behind.

Environment

- OS: Ubuntu Server 24.04, kernel 6.8
- How docker service was installed: community edition repo added to apt

CPU architecture

x86-64

Docker creation

services:
  wireguard:
    image: linuxserver/wireguard:latest
    container_name: wireguard
    read_only: true
    network_mode: host
    cap_add:
      - NET_ADMIN
    environment:
      - PUID=1000
      - PGID=1000
      - TZ=America/Los_Angeles
      - SERVERURL=<redacted>
      - SERVERPORT=51820
      - PEERS=2
      - USE_COREDNS=false
      - INTERNAL_SUBNET=10.14.15.0/24
      - ALLOWEDIPS=10.0.0.0/24,10.14.15.0/24
      - PERSISTENTKEEPALIVE_PEERS=all
    volumes:
      - ./config:/config
    tmpfs:
      - /run:exec
    restart: unless-stopped

Container logs

───────────────────────────────────────
GID/UID
───────────────────────────────────────

User UID:    1000
User GID:    1000
───────────────────────────────────────
Linuxserver.io version: 1.0.20260223-r0-ls118
Build-date: 2026-07-16T12:47:37+00:00
───────────────────────────────────────

Uname info: Linux PacketFucker3000 6.8.0-136-generic #136-Ubuntu SMP PREEMPT_DYNAMIC Wed Jul  1 21:53:05 UTC 2026 x86_64 GNU/Linux
**** Server mode is selected ****
**** PersistentKeepalive will be set for: all ****
**** External server address is set to <redacted> ****
**** External server port is set to 51820. Make sure that port is properly forwarded to port 51820 inside this container ****
**** Internal subnet is set to 10.14.15.0/24 ****
**** AllowedIPs for peers 10.0.0.0/24,10.14.15.0/24 ****
**** PEERDNS var is either not set or is set to "auto", setting peer DNS to 10.14.15.1 to use wireguard docker host's DNS. ****
**** Server mode is selected ****
**** No changes to parameters. Existing configs are used. ****
[custom-init] No custom files found, skipping...
**** Disabling CoreDNS ****
**** Found WG conf /config/wg_confs/wg0.conf, adding to list ****
**** Activating tunnel /config/wg_confs/wg0.conf ****
wg-quick: `wg0' already exists
**** Tunnel /config/wg_confs/wg0.conf failed, will stop all others! ****
RTNETLINK answers: No such process
**** All tunnels are now down. Please fix the tunnel config /config/wg_confs/wg0.conf and restart the container ****
[ls.io-init] done.