[BUG] PEERDNS env variable unexpected behavior

[javiersilva0]

Is there an existing issue for this?

• I have searched the existing issues

Current Behavior

Documentation here reports that PEERDNS defaults to auto, which should make use of CoreDNS.

However, currently there is a difference between these two cases:

• Not setting any value for PEERDNS when deploying the container. In this case, the DNS service is not initialized, as evidenced by container logs below.
• Setting PEERDNS=auto. In this case, the DNS service works as expected.

Expected Behavior

Since PEERDNS defaults to auto, there should be no difference between the two situations. Thus, the DNS server should work in both cases.

Steps To Reproduce

1. Deploy both versions of the Podman Quadlet below (i.e. with and without the Environment=PEERDNS=auto line.
2. Check logs, or attempt to use the DNS server from a WireGuard client.

Environment

- OS: Debian
- How podman service was installed: `apt`
- How the container was deployed: Podman Quadlet

CPU architecture

x86-64

Docker creation

[Unit]
Description="WireGuard VPN server"
Wants=network-online.target
After=network-online.target
After=local-fs.target

[Container]
ContainerName="wireguard-server"
Image=lscr.io/linuxserver/wireguard

Volume=wireguard-server:/config

Network=host

AddCapability=NET_ADMIN 
AddCapability=NET_RAW 
PublishPort=51820:51820/udp

Environment=SERVERPORT=51820
Environment=SERVERURL=auto
Environment=PEERS=<redacted>
Environment=TZ=<redacted>
Environment=PEERDNS=auto    # this line is the only difference between the two configurations
Environment=INTERFACE=enp1s0

AutoUpdate=registry

[Service]
Restart=on-failure
TimeoutStartSec=900

[Install]
WantedBy=default.target

Container logs

Without setting any value for PEERDNS:

───────────────────────────────────────

      ██╗     ███████╗██╗ ██████╗
      ██║     ██╔════╝██║██╔═══██╗
      ██║     ███████╗██║██║   ██║
      ██║     ╚════██║██║██║   ██║
      ███████╗███████║██║╚██████╔╝
      ╚══════╝╚══════╝╚═╝ ╚═════╝

   Brought to you by linuxserver.io
───────────────────────────────────────

To support the app dev(s) visit:
WireGuard: https://www.wireguard.com/donations/

To support LSIO projects visit:
https://www.linuxserver.io/donate/

───────────────────────────────────────
GID/UID
───────────────────────────────────────

User UID:    911
User GID:    911
───────────────────────────────────────
Linuxserver.io version: 1.0.20260223-r0-ls120
Build-date: 2026-08-06T13:03:25+00:00
───────────────────────────────────────

Uname info: Linux SERVER-1 6.12.107+deb13-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.12.107-1 (2026-08-29) x86_64 GNU/Linux
**** Server mode is selected ****
**** SERVERURL var is either not set or is set to "auto", setting external IP to auto detected value of <redacted> ****
**** External server port is set to 51820. Make sure that port is properly forwarded to port 51820 inside this container ****
**** Internal subnet is set to 10.13.13.0 ****
**** AllowedIPs for peers 0.0.0.0/0, ::/0 ****
**** PEERDNS var is either not set or is set to "auto", setting peer DNS to 10.13.13.1 to use wireguard docker host's DNS. ****
**** Server mode is selected ****
**** No changes to parameters. Existing configs are used. ****
[custom-init] No custom files found, skipping...
**** Disabling CoreDNS ****
**** Found WG conf /config/wg_confs/wg0.conf, adding to list ****
**** Activating tunnel /config/wg_confs/wg0.conf ****
[#] ip link add dev wg0 type wireguard
[#] wg addconf wg0 /dev/fd/63
[#] ip -4 address add 10.13.13.1 dev wg0
[#] ip link set mtu 1420 up dev wg0
[#] ip -4 route add 10.13.13.6/32 dev wg0
[#] ip -4 route add 10.13.13.5/32 dev wg0
[#] ip -4 route add 10.13.13.4/32 dev wg0
[#] ip -4 route add 10.13.13.3/32 dev wg0
[#] ip -4 route add 10.13.13.2/32 dev wg0
[#] iptables -A FORWARD -i wg0 -j ACCEPT; iptables -A FORWARD -o wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o enp1s0 -j MASQUERADE
**** All tunnels are now active ****
[ls.io-init] done.

=========================

Setting `PEERDNS=auto`:

───────────────────────────────────────

      ██╗     ███████╗██╗ ██████╗
      ██║     ██╔════╝██║██╔═══██╗
      ██║     ███████╗██║██║   ██║
      ██║     ╚════██║██║██║   ██║
      ███████╗███████║██║╚██████╔╝
      ╚══════╝╚══════╝╚═╝ ╚═════╝

   Brought to you by linuxserver.io
───────────────────────────────────────

To support the app dev(s) visit:
WireGuard: https://www.wireguard.com/donations/

To support LSIO projects visit:
https://www.linuxserver.io/donate/

───────────────────────────────────────
GID/UID
───────────────────────────────────────

User UID:    911
User GID:    911
───────────────────────────────────────
Linuxserver.io version: 1.0.20260223-r0-ls120
Build-date: 2026-08-06T13:03:25+00:00
───────────────────────────────────────

Uname info: Linux SERVER-1 6.12.107+deb13-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.12.107-1 (2026-08-29) x86_64 GNU/Linux
**** Server mode is selected ****
**** SERVERURL var is either not set or is set to "auto", setting external IP to auto detected value of <redacted> ****
**** External server port is set to 51820. Make sure that port is properly forwarded to port 51820 inside this container ****
**** Internal subnet is set to 10.13.13.0 ****
**** AllowedIPs for peers 0.0.0.0/0, ::/0 ****
**** PEERDNS var is either not set or is set to "auto", setting peer DNS to 10.13.13.1 to use wireguard docker host's DNS. ****
**** Server mode is selected ****
**** No changes to parameters. Existing configs are used. ****
[custom-init] No custom files found, skipping...
maxprocs: Leaving GOMAXPROCS=4: CPU quota undefined
.:53
CoreDNS-1.13.2
linux/amd64, go1.26.3,
**** Found WG conf /config/wg_confs/wg0.conf, adding to list ****
**** Activating tunnel /config/wg_confs/wg0.conf ****
[#] ip link add dev wg0 type wireguard
[#] wg addconf wg0 /dev/fd/63
[#] ip -4 address add 10.13.13.1 dev wg0
[#] ip link set mtu 1420 up dev wg0
[#] ip -4 route add 10.13.13.6/32 dev wg0
[#] ip -4 route add 10.13.13.5/32 dev wg0
[#] ip -4 route add 10.13.13.4/32 dev wg0
[#] ip -4 route add 10.13.13.3/32 dev wg0
[#] ip -4 route add 10.13.13.2/32 dev wg0
[#] iptables -A FORWARD -i wg0 -j ACCEPT; iptables -A FORWARD -o wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o enp1s0 -j MASQUERADE
**** All tunnels are now active ****
[ls.io-init] done.

[github-actions]

Thanks for opening your first issue here! Be sure to follow the relevant issue templates, or risk having this issue marked as invalid.

[thespad]

The logic is the same for both empty and auto values for PEERDNS

    if [[ -z "$PEERDNS" ]] || [[ "$PEERDNS" = "auto" ]]; then
        PEERDNS="${INTERFACE}.1"
        echo "**** PEERDNS var is either not set or is set to \"auto\", setting peer DNS to ${INTERFACE}.1 to use wireguard docker host's DNS. ****"

And you can tell you're hitting that path in both cases by the log message.

The only logic I could see you hitting, giving you're running with host networking is:

if netstat -apn | grep -q ":53 " && [[ -z "${USE_COREDNS}" ]]; then
    USE_COREDNS="false"
fi

...

if [[ ${USE_COREDNS} == "false" ]]; then
    s6-notifyoncheck -d -n 300 -w 1000 -c "echo **** Disabling CoreDNS ****" \
        sleep infinity
else

But that applies the same regardless of the PEERDNS setting, so unless you explicitly set USE_COREDNS somewhere (it's an intentionally undocumented option) it should never trigger or always trigger.