Docker bridge
The Python worker originates automation traffic from the IntelliconOps container network.
Private automation path
Reach private Azure workloads from your Docker host—without public SSH.
IntelliconOps uses a WireGuard bridge between the host running its Docker platform and a lightweight router inside the Azure VNet, giving Python and Ansible a controlled route to private workload addresses.
Discuss private connectivityPrivate traffic path
Docker worker
Starts SSH and Ansible traffic inside the platform.
Linux or WSL host
Forwards Docker bridge traffic onto the host wg0 interface.
WireGuard tunnel
Encrypts traffic between authenticated host and Azure peers.
Private Azure VM
Receives automation traffic through the VNet router.
How the bridge works
Keep cloud workloads private while the automation path remains reachable.
Host forwarding
The Docker host routes and, where required, translates container traffic onto wg0.
Encrypted tunnel
WireGuard carries authenticated traffic to the Azure router over its UDP endpoint.
Azure VNet router
The router forwards tunnel traffic to workload private IPs and handles the return path.
Guided private-network setup
Configure, provision, connect and verify the tunnel.
The connectivity page creates an ordered plan for Azure resources and host-side WireGuard steps, then verifies the route and recent handshake.
Select any screenshot to inspect it at full size.
Configure the network
Choose WireGuard, identify the Azure VNet and workload subnet, then define the tunnel range, UDP port and router.
Review the provisioned foundation
Confirm automation SSH readiness, router and NAT settings, expected costs and the generated provisioning plan.
Build the bridge
Run the ordered Azure steps, configure both peers and enable Docker-to-WireGuard forwarding where WSL requires it.
Verify and operate
Test router reachability, the workload route and a recent WireGuard handshake, then retain an explicit teardown path.
Supported host patterns
Put the peer on the host that owns Docker networking.
WSL development
Install WireGuard in the WSL distribution that owns wg0 and persist the Docker bridge forwarding rules across restarts.
DigitalOcean deployment
Use the customer droplet as the initiating peer and route its IntelliconOps container traffic through the tunnel.
Other Linux Docker hosts
Apply the same host-level pattern where the server supports WireGuard, forwarding, firewall rules and persistent services.
Network safeguards
Make private reachability observable and reversible.
- Reject overlapping tunnel, Docker and workload address ranges
- Keep WireGuard private keys on their respective hosts
- Allow workload SSH from the tunnel boundary rather than the public internet
- Verify router reachability, workload routing and handshake freshness
- Expose ordered teardown steps for provisioned networking resources
Current operating boundary: the guided setup still includes host-level installation, peer key exchange and forwarding steps that an authorised operator must complete.
Private infrastructure automation
Connect the worker to the workload without exposing every workload to the internet.
Use a repeatable WireGuard route from the Docker host to the Azure VNet, then let governed Python and Ansible workflows operate over private addresses.
Explore Python and Ansible executionSee IntelliconOps in action
Give every cloud request a clear, controlled path.
Tell us how your teams manage infrastructure today. We will show you how IntelliconOps can simplify the work.
Book a demonstration