Sign inSign up

quiq/openvpn

By quiq

•Updated over 5 years ago

Minimal secure openvopn container

Image
1

1.6K

quiq/openvpn repository overview

Dockerfile:

FROM alpine:edge

RUN apk add --no-cache --upgrade openvpn python3 py3-pip py3-yaml libssl1.1 &&
pip3 install pyotp

WORKDIR /etc/openvpn CMD ["openvpn", "--config", "/etc/openvpn/openvpn.conf"]

Features:

  • Image is signed with Notary
  • Minimal alpine image

Ansible example to verify signature and run in read-only container

  • verifies signature
  • /etc/openvpn contains the openvpn configuration on the host machine
  • /var/lib/nobody_tmp_secure in a bind mount from /var/lib/nobody_tmp with noexec,nosuid,nodev
- set_fact:
    openvpn_version: 2.5.1

- name: Pull docker images with signature check
  command: docker pull {{item}}
  with_items:
    - quiq/openvpn:{{openvpn_version}}
  environment:
    DOCKER_CONTENT_TRUST: 1
  register: docker_pull
  changed_when: '"Downloaded newer image" in docker_pull.stdout'

- name: Make special docker tmp directories
  file: path={{item}} state=directory mode=2750 owner=root group=nogroup
  with_items:
    - /var/lib/nobody_tmp/openvpn

- name: Start openvpn docker container
  docker_container:
    name: openvpn
    labels: {"name": "openvpn"}
    image: quiq/openvpn:{{openvpn_version}}
    state: started
    restart_policy: always
    network_mode: host
    capabilities: NET_ADMIN
    read_only: True
    volumes:
      - /etc/openvpn:/etc/openvpn:ro
      - /etc/openvpn/otp_tracking:/etc/openvpn/otp_tracking
      - /dev/net/:/dev/net:ro
      - /var/lib/nobody_tmp_secure/openvpn:/tmp

Tag summary

Content type

Image

Digest

Size

26.3 MB

Last updated

over 5 years ago

docker pull quiq/openvpn