Menu
Some apps we have depend on being connected to our VPN to connect to different (not-yet dockerized)solutions.
What is the 'docker way' of doing this? In my mind adding OpenVPN to an existing image is against the docker philosophy.
From where I'm standing I feel that creating a docker VPN client container makes the most sense. But what would that look like? I use docker compose, so there would definitely be a
myContainer
- links: myVPNClient
but would I then have to forward ports? Or what would have to happen to enable myContainer to connect through the openVPN container.
834
VPN Passthrough Docker Desktop networking can work when attached to a VPN. To do this, Docker Desktop intercepts traffic from the containers and injects it into the host as if it originated from the Docker application.
To make a port available to services outside of Docker, or to Docker containers which are not connected to the container's network, use the --publish or -p flag. This creates a firewall rule which maps a container port to a port on the Docker host to the outside world.
It's an open source project and provides the same basic functionality the Docker engine does but without root privileges. It works by creating a chroot -like environment over the extracted container and uses various implementation strategies to mimic chroot execution with just user-level privileges.
Another option would be to ask Jess Frazelle (jfrazelle), who is in the habit of containerizing everything.
Sure enough, she has a jfrazelle/dockerfiles/openvpn project which exposes it directly to the host:
vpn:
build: .
volumes:
- .:/etc/openvpn
net: host
devices:
- /dev/net/tun:/dev/net/tun
cap_add:
- NET_ADMIN
It uses a TUN (not TAP) interface.
195
Probably the easiest solution would be to configure any containers that need the vpn to use the network namespace of the vpn container. That is, your docker-compose.yml would include something like:
vpn:
image: myvpn_image
app1:
image: app1_image
net: container:vpn
With this configuration, the vpn container and the app1 container see the same network evironment.
6
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With
