Docker-openvpn: Using a VPN Solution in a docker swarm encrypted overlay network

[quorak]

Hey @kylemanna,

maybe you have an idea. We want to vpn into a docker swarm overlay network and found your conteinered solution. Unfortunately docker swarm doesnt allow any --privileged mode and probably won't in near future (https://github.com/docker/docker/pull/26849#issuecomment-252704844).

Due to the encryption its also not possible to add a service in normal docker run mode to the overlay network (https://docs.docker.com/engine/userguide/networking/overlay-security-model/).

Is there any possibility to run the vpn service without priviliged capabilities?

thanks a lot

[kylemanna]

The server used to use --privileged flag, but with modern versions of docker with more granular control it works just fine with --cap-add=NET_ADMIN. I don't think there is anyway around the NET_ADMIN capability as it's creating a userspace network interface and manipulating the network interface.

[quorak]

ah. damn. but thanks for the fast reply.

[tlvenn]

Same boat as Quork, it seems the guys from weave figured a hack to do this: https://github.com/weaveworks/scope-global-swarm-service

[tlvenn]

I am not 100% that the approach of a jump container is applicable to openvpn though

[quorak]

@tlvenn don think this will work. It only allows the container to execute docker commands in behalf of the host system but won allow access to the hosts devices.

[tlvenn]

Ya indeed it would not work sadly.

[morph027]

With attachable swarm networks, you might get a chance to run a docker outside swarm with all necessary flags but still being able to have one leg inside swarm: http://blog.alexellis.io/docker-stacks-attachable-networks/

[Shinoby1992]

after 2 years, still now way that it work?
im reading now 24hours through all possible openvpn clients that i found and try out to find a solution... i have a swarm, and i have somehow get it stack deployed that other containers can use the openvpn network i still couldn't find a way to solve this

[evertramos]

@Shinoby1992 if you find please update this issue... I am in the same situation.

Thanks!

[ghost]

Yes also looking for something like this...

[acidoxee]

Has anyone ever achieved something like this with Docker Swarm? I'd like to have a VPN in my Swarm cluster to access private services, so as not to expose them _via_ host bindings nor a reverse proxy.