fix: handle EAFNOSUPPORT in RouteList for Virtuozzo/OpenVZ kernels

[Wenri]

Summary

• Virtuozzo/OpenVZ 3.10.x kernels do not support RTM_GETROUTE dump with AF_UNSPEC, returning EAFNOSUPPORT. This caused netclient to fail on interface configuration and default gateway detection, preventing the daemon from applying any peer updates.
• Add routeListAll and routeListFilteredAll helpers that try FAMILY_ALL first and fall back to querying FAMILY_V4 and FAMILY_V6 separately when EAFNOSUPPORT is returned.
• Set WG_QUICK_USERSPACE_IMPLEMENTATION env var in Dockerfile for userspace WireGuard support in containers.

Test plan

• Verify netclient starts and applies peer updates on Virtuozzo/OpenVZ hosts with 3.10.x kernels
• Verify no regression on standard Linux kernels (route listing should use FAMILY_ALL as before)
• Verify Docker container picks up the WG_QUICK_USERSPACE_IMPLEMENTATION env var

🤖 Generated with Claude Code

[CLAassistant]

All committers have signed the CLA.

[Copilot]

Pull request overview

This PR addresses route enumeration failures on Virtuozzo/OpenVZ 3.10.x kernels where RTM_GETROUTE dumps using AF_UNSPEC return EAFNOSUPPORT, which can prevent netclient from configuring interfaces and detecting the default gateway. It introduces netlink route-list helper functions that fall back to per-family queries, and updates the container image configuration for userspace WireGuard selection.

Changes:

• Replace direct netlink.RouteList(..., FAMILY_ALL) / RouteListFiltered(..., FAMILY_ALL) usage with helpers that fall back to V4+V6 queries on EAFNOSUPPORT.
• Add routeListAll and routeListFilteredAll helper functions to wireguard_linux.go.
• Set WG_QUICK_USERSPACE_IMPLEMENTATION=wireguard-go in the main Dockerfile.

Reviewed changes

Copilot reviewed 65 out of 66 changed files in this pull request and generated 3 comments.

File	Description
wireguard/wireguard_linux.go	Adds EAFNOSUPPORT fallback helpers and routes callers through them to avoid failing on AF_UNSPEC route dumps.
Dockerfile	Sets WG_QUICK_USERSPACE_IMPLEMENTATION to prefer userspace WireGuard behavior in containers.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

In the EAFNOSUPPORT fallback, IPv6 route listing errors are currently ignored (v6, _ := ...), and the function also hard-fails if the IPv4 query fails even if IPv6 would succeed. This can silently drop IPv6 routes or incorrectly return an error on IPv6-only systems. Consider capturing err6 and returning a combined result when one family succeeds, only failing when both V4 and V6 queries fail (optionally ignoring only expected 'not supported' errors).

[Copilot]

Same issue as routeListAll: the EAFNOSUPPORT fallback ignores the IPv6 error and requires the IPv4 filtered query to succeed. This can hide real failures from the caller and/or break IPv6-only setups. Please handle err6 and only return an error if both family-specific queries fail (treating 'not supported' errors as non-fatal if desired).