使用 vpn 时的 docker 容器网络访问

Question

Expected Result:

Container can access each other thru hostname or hostcomputer ip.

Actual Result:

When using network_mode I can't make any changes as static ip or links to other containers.

Description:

I've a couple of containers all using --net (network_mode) to a openvpn. As single instances they work and with nginx proxy I can access each from any computer.

However the containers can't find each other except with local ip (172.19.0.x). I could use that but what happens on host reboot. Will the ip addresses change?

docker-compose.yml

version: '3.4'
services:

    vpn:
        image: dperson/openvpn-client
        container_name: vpn
        cap_add:
            - net_admin
        networks:
            - default
        tmpfs:
            - /tmp
        restart: unless-stopped
        security_opt:
            - label:disable
        stdin_open: true
        tty: true
        volumes:
            - ../openvpn:/vpn
            - /dev/net:/dev/net:z
        environment:
            - DNS='8.8.4.4 8.8.8.8'
            - FIREWALL="1"
            - TZ='Europe/Stockholm'
        command: -f ""
        networks:
            - default

    proxy:
        image: nginx
        container_name: proxy
        environment:
            TZ: 'Europe/Stockholm'
        ports:
            - "6003:8989" # sonarr
            - "6004:7878" # radarr
            - "6001:8112" # deluge
            - "6002:9117" # jackett
        depends_on:
            - sonarr
            - radarr
            - deluge
            - jackett
        links:
            - vpn:sonarr
            - vpn:radarr
            - vpn:deluge
            - vpn:jackett
        networks:
            - default
        volumes:
            - ../nginx/default.conf:/etc/nginx/conf.d/default.conf
        restart: always
        command: "nginx -g 'daemon off;'"

    sonarr:
        image: linuxserver/sonarr
        container_name: sonarr
        volumes:
            - ../sonarr:/config
            - /etc/localtime:/etc/localtime:ro
            - /media/megadrive/Media/Series:/tv
            - /media/megadrive/Media/tmp/completed:/downloads
        env_file: ../uidgid.env
        network_mode: "service:vpn"
        environment:
            - TZ='Europe/Stockholm'
        cap_add:
            - net_admin
        depends_on:
            - vpn
        restart: always


    radarr:
        image: linuxserver/radarr
        container_name: radarr
        volumes:
            - ../radarr:/config
            - /media/megadrive/Media/Movies:/movies
            - /media/megadrive/Media/tmp/completed:/downloads
            - /etc/localtime:/etc/localtime:ro
        env_file: ../uidgid.env
        network_mode: "service:vpn"
        environment:
            - TZ='Europe/Stockholm'
        cap_add:
            - net_admin
        depends_on:
            - vpn
        restart: always

    deluge:
        image: linuxserver/deluge
        container_name: deluge
        depends_on:
            - vpn
        network_mode: "service:vpn"
        volumes:
            - ../deluge:/config
            - /media/megadrive/Media/tmp/:/downloads
            - /etc/localtime:/etc/localtime:ro
        restart: always
        env_file: ../uidgid.env
        environment:
            - TZ='Europe/Stockholm'

    jackett:
        container_name: jackett
        image: linuxserver/jackett
        restart: unless-stopped
        network_mode: "service:vpn"
        env_file: ../uidgid.env
        environment:
            - TZ='Europe/Stockholm'
        volumes:
            - ../jackett:/config
            - /media/megadrive/Media/tmp/blackhole:/downloads

networks:
    default:

Answer 1

It seems that letting vpn service use host instead of bridge (default). Will solve a couple of things.

• Allow everything to work on host computer ip. As long as every service is on its own port this is okay.
• Services still seems to be following openvpn rules

• no more need for nginx for proxy to the webgui

   vpn: image: dperson/openvpn-client container_name: vpn cap_add: - net_admin tmpfs: - /tmp restart: unless-stopped security_opt: - label:disable stdin_open: true tty: true volumes: - ../openvpn:/vpn - /dev/net:/dev/net:z environment: - DNS='8.8.4.4 8.8.8.8' - FIREWALL="1" - TZ='Europe/Stockholm' command: -f "" network_mode: "host"

Answer 2

The other option is that the services in the vpn use localhost to access each other. Since they share the network stack of the vpn container they are accessed as if they were the same host. This one had me stumped for a while this week.

One comment, you've got net_admin on all your containers, you only need it on the vpn