此应用的核心功能必须使用以下权限，不能删除：NET_ADMIN、NET_RAW、宿主机设备映射 /dev/net/tun:/dev/net/tun，以及 IPv4/IPv6 转发 sysctl。它们允许容器配置网络接口和路由、使用 TUN 设备并转发网络流量；这不是普通 Web 应用的权限模型。请只使用官方镜像，保护节点令牌，不要把令牌写入日志或提交到代码仓库，并在主机防火墙中限制不必要的转发路径。

容器镜像使用 Cloudflare 产品条款，Cloudflare Mesh 连接器并非本适配项目重新编译的开源镜像。部署和再分发时请遵守 Cloudflare Terms 以及 Cloudflare One 的产品条款。

当前使用的 2026.7.0 镜像版本扫描还发现了未解决的 High 级基础镜像告警（CVE-2026-38754、CVE-2026-14456，涉及 BusyBox/OpenSSL 软件包）。这些问题位于厂商镜像内部，本适配不会自行修补；请关注 Cloudflare 发布的修复镜像并及时更新镜像 tag。

数据与升级

连接器状态保存在 mesh_data 命名卷中；卸载脚本不会删除该卷，迁移或升级前请在 1Panel 中备份。
运行环境必须支持 Linux TUN 设备和所需的 IPv4/IPv6 转发设置；如果宿主机没有 /dev/net/tun，连接器无法完成正常连接。
可在容器内执行 warp-cli status 查看连接器状态；不要在输出或日志中暴露节点令牌。

清理旧状态并重新注册

如果更换了节点令牌，或需要丢弃当前连接器身份并重新注册：

先在 1Panel 应用配置中保存新的 MESH_NODE_TOKEN。
进入当前应用版本目录，执行 bash scripts/reset-registration.sh --confirm。
脚本会严格确认当前 Compose 只有本应用的 cloudflare-mesh 服务和 mesh_data 命名卷，然后停止应用、删除 mesh_data 中的本地注册状态，并用当前令牌重建容器。
执行 docker compose exec -T cloudflare-mesh warp-cli status，并在 Cloudflare 控制台确认新节点已上线。

该操作不可恢复旧的本地连接器身份，只删除本机 mesh_data 注册状态，不会删除 Cloudflare 控制台中的旧节点；如不再使用旧节点，请在控制台中按需删除或停用。只修改令牌而不执行上述流程时，持久化卷中的旧注册状态仍可能优先生效。

Introduction

Cloudflare Mesh is a private-network connector container for Cloudflare One. It has no web administration interface or published service port; it establishes and maintains the network connection through the Cloudflare control plane.

Features

Registers the connector with a Cloudflare Mesh node token
Supports private-network connectivity and a source-NAT toggle
Persists Cloudflare WARP connector state in a named volume
Supports amd64 and arm64 Linux hosts

Access

Enter the node token generated by the Cloudflare dashboard in MESH_NODE_TOKEN; treat it as a secret.
This application publishes no HTTP or TCP service port. Check connector state in the Cloudflare dashboard.
SRCNAT_ENABLED is enabled by default and should only be changed as part of a planned address-translation design.

Security and Deployment Risks

The connector requires these permissions for its core function and they must remain enabled: NET_ADMIN, NET_RAW, the host device mapping /dev/net/tun:/dev/net/tun, and IPv4/IPv6 forwarding sysctls. They let the container configure network interfaces and routes, use the TUN device, and forward traffic; this is not the permission model of an ordinary web application. Use only the official image, protect the node token, never commit it or write it to logs, and restrict unnecessary forwarding paths with the host firewall.

The image contains Cloudflare product software and is not rebuilt as an open-source image by this package. Follow the Cloudflare Terms and Cloudflare One product terms when deploying or redistributing it.

The currently used 2026.7.0 image version also has unresolved High-severity base-image findings (CVE-2026-38754 and CVE-2026-14456, affecting BusyBox/OpenSSL packages). They are inside the vendor image and are not patched by this package; update the image tag when Cloudflare publishes a fixed build.

Data and upgrades

Connector state is stored in the mesh_data named volume. The uninstall helper does not remove it; back up the application in 1Panel before migration or upgrades.
The host must provide the Linux TUN device and support the required IPv4/IPv6 forwarding settings. Without /dev/net/tun, the connector cannot establish a normal connection.
Run warp-cli status inside the container to inspect connector state; do not expose the node token in command output or logs.

Clear old state and re-register

When the node token changes, or when the connector identity must be discarded and registered again:

Save the new MESH_NODE_TOKEN in the 1Panel application configuration.
From the current application version directory, run bash scripts/reset-registration.sh --confirm.
The script verifies that the Compose project contains only this application's cloudflare-mesh service and mesh_data volume, stops the application, removes the local registration state from mesh_data, and recreates the container with the configured token.
Run docker compose exec -T cloudflare-mesh warp-cli status and confirm that the new node is online in the Cloudflare dashboard.

This operation cannot restore the old local connector identity. It removes only the local mesh_data registration state and does not delete the old node from the Cloudflare dashboard; delete or disable that node there if it is no longer needed. Changing the token without this procedure may leave the persisted old registration state in control.