mirror of
https://github.com/hwdsl2/docker-ipsec-vpn-server.git
synced 2026-04-26 01:55:53 +03:00
[GH-ISSUE #184] Remove --privileged #169
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @0az on GitHub (Apr 26, 2020).
Original GitHub issue: https://github.com/hwdsl2/docker-ipsec-vpn-server/issues/184
I don't have a patch for this yet. I may not be able to put out a patch for this in the foreseeable future, but this should be possible.
As such, we should be able to downgrade
--privilegedto--cap-add NET_ADMIN, while asking the user to set up the sysctls using eitherdocker-composeor through the Docker command line args from script invocation.And a question, since I'm not familiar with sysctls: are the
kernel.*sysctls necessary?@hwdsl2 commented on GitHub (Apr 26, 2020):
@0az Thank you for the suggestion. As discussed in https://github.com/hwdsl2/docker-ipsec-vpn-server/issues/21#issuecomment-581108616, using
--cap-add NET_ADMINinstead of--privilegeddoes not work for IPsec/L2TP mode (the connection will fail). Therefore the latter is required for this Docker image to work as intended.For the
kernel.*sysctls, some of them are intended to enhance security and/or VPN performance, while others are required for the VPN to work, e.g.net.ipv4.ip_forward=1and [1] [2].[1] https://libreswan.org/wiki/FAQ#Why_is_it_recommended_to_disable_send_redirects_in_.2Fproc.2Fsys.2Fnet_.3F
[2] https://libreswan.org/wiki/FAQ#Why_is_it_recommended_to_disable_rp_filter_in_.2Fproc.2Fsys.2Fnet_.3F