GitHub Actions · Ubuntu 26.04 · Checked November 4, 2026

wg-quick "wg0.conf: Permission denied" on Ubuntu 26.04: the new AppArmor profile

ubuntu-latest is moving from Ubuntu 24.04 to 26.04 between October 19 and November 19, 2026 (what else changes). Ubuntu 26.04's apparmor package (5.0.0~beta1) adds profiles for /usr/bin/wg-quick and /usr/bin/wg; Ubuntu 24.04 has neither. Both profiles are in enforce mode and allow WireGuard configuration and key files only under /etc/wireguard/. Root does not get past AppArmor, so sudo does not help.

What it looks like

/usr/bin/wg-quick: line 40: /home/runner/work/<repository>/<repository>/wg0.conf: Permission denied
Error: Process completed with exit code 1.

This is the step that writes the configuration to the checkout directory and runs sudo wg-quick up ./wg0.conf. The same file in the same place works on 24.04.

Where the reports came from

• A workflow that connects to a VPN with niklaskeerl/easy-wireguard-action@v2 failed this way on ubuntu-latest and was pinned to ubuntu-24.04 (easy-wireguard-action #5). A pull request moves the action to /etc/wireguard/wg0.conf and wg-quick up wg0; it is not merged yet (#4).
• The rule is in Ubuntu's own copy of the profile: file rw @{etc_rw}/wireguard/{,**}, (profiles/apparmor.d/wg-quick, and the same line in wg).

Fix: write the configuration to /etc/wireguard

- name: Connect WireGuard
  env:
    WG_CONFIG: ${{ secrets.WG_CONFIG }}
  run: |
    sudo apt-get install --yes wireguard-tools
    sudo install -d -m 700 /etc/wireguard
    sudo install -m 600 /dev/null /etc/wireguard/wg0.conf
    printf '%s\n' "$WG_CONFIG" | sudo tee /etc/wireguard/wg0.conf > /dev/null
    sudo wg-quick up wg0

Give wg-quick the interface name, not a path, so it reads /etc/wireguard/wg0.conf. The file is created empty with mode 600 before the secret goes in, and tee writes it without printing it to the log. The same applies to wg setconf and to wg set ... private-key: keep the key files under /etc/wireguard/ too.

If you use a WireGuard action, check whether its current version already does this before you fork it.

Or pin the runner

runs-on: ubuntu-24.04 has no WireGuard profiles, so the old step works there, until GitHub retires that image.

Telling it apart

• Ask the kernel log right after the failure: sudo dmesg | grep 'apparmor="DENIED"' | grep wg. A line with profile="wg-quick" and your file's path is this problem.
• sudo aa-status | grep wg shows whether the wg and wg-quick profiles are loaded, and in which mode.
• "Permission denied" with a file under /etc/wireguard/ is not this profile. Check the file's owner and mode.
• Look at "Set up job": the Runner Image group shows the image. Until November 19 a re-run can land on 24.04 and pass, so a green re-run proves nothing.

Other 26.04 failures

• Postgres never starts in Docker on Ubuntu 26.04: newer kernels such as 7.0.0-42 run container processes as docker-default//&unconfined, so they cannot signal each other and gosu hangs at 100% CPU; reported on self-hosted runners so far.
• setup-swift on Ubuntu 26.04: swift-actions/setup-swift v2 stops with "Version "26.04" of Ubuntu is not supported", and swift.org has 26.04 builds only from Swift 6.4.0; use the image's Swift 6.4.1 or the swift container.
• Docker-in-Docker on Ubuntu 26.04: the legacy iptables modules are not loaded, so a dockerd inside a container that uses iptables-legacy, such as the dev container docker-in-docker feature :2 or :3, fails with "can't initialize iptables table `nat'"; move the feature to :4 or load the modules on the runner.
• apt on Ubuntu 26.04: renamed and removed packages.
• "coreutils: unknown program": most core tools are uutils.

See failed jobs from IntelliJ IDEA

Pipeline Inbox for GitHub Actions Workflows, a plugin by Lesstep for JetBrains IDEs 2024.1 or later, lists the runs of all your repositories in an IDE tool window, with their jobs and steps, and your current branch's runs are in the status bar. Reading is free; re-running failed jobs, cancelling, running workflows and reviewing deployments are Pro (US$1.50 a month, with a 30-day trial).

Get it on JetBrains Marketplace

GitHub and GitHub Actions are trademarks of GitHub, Inc.; Ubuntu is a trademark of Canonical Ltd.; WireGuard is a registered trademark of Jason A. Donenfeld; IntelliJ IDEA is a trademark of JetBrains s.r.o. This page is not affiliated with, sponsored or endorsed by GitHub, Inc., Canonical, the WireGuard project or JetBrains.

More: "The ubuntu-latest label will migrate to Ubuntu 26" · Postgres never starts in Docker on Ubuntu 26.04 · GitHub Actions plugins for IntelliJ IDEA compared · 日本語