aw1cks/openconnect repository overview

⁠OpenConnect Docker Container

⁠Why?

OpenConnect doesn't ship with any init scripts or systemd units. It's also not easy to non-interactively provide username, password and especially OTP. Additionally, running in a docker container gives some extra flexibility with routing.

⁠Where can I download it?

The image is built by GitHub Actions for amd64 & arm64 and pushed to the following repositories:

• Docker Hub⁠
• GitHub Container Registry⁠
• quay.io⁠

There is additionally a build running in GitLab CI published to:

• GitLab⁠

⁠How do I use it?

It's recommended to use the helper scripts as described below⁠.

Otherwise, you can run the container using the specified arguments below.

⁠Basic container command

docker run -d \
--cap-add NET-ADMIN \
-e URL=https://my.vpn.com \
-e USER=myuser \
-e AUTH_GROUP=mygroup \
-e PASS=mypassword \
-e OTP=123456 \
-e SEARCH_DOMAINS="my.corporate-domain.com subdomain.my.corporate-domain.com" \
docker.io/aw1cks/openconnect'

⁠All container arguments

⁠Helper scripts

The provided helper scripts in examples/ will create the container for you and set up the routing table appropriately.

⁠Requirements

• docker
• sudo (and permissions to run ip and docker as root)
• iproute2
• jq

⁠How do they work?

1. The env file is sourced from the same directory the script lives in
2. From the above file, all the container arguments are derived. These are passed using -e as environment variables to the container.
3. The container is spawned, then the address of the container is found using docker inspect piped to jq.
4. The routes specified in the env file are added to the host routing table, via the container address discovered in the previous step.
5. The host resolv.conf is backed up to /etc/resolv.conf.orig, then modified to point to the local container on 127.0.0.1.

The script which stops the VPN cleans up the routing table, tears down the container, and restores the original resolv.conf.

⁠How do I use them?

$ cd $(git rev-parse --show-cdup)
$ cp examples/* .
$ $EDITOR env # set your values here
$ ./run.sh
$ ./stop.sh # Tears down the container and cleans up the routing table

⁠Building the container yourself

The following build args are used:

• BUILD_DATE (RFC3339 timestamp)
• COMMIT_SHA (commit hash from which image was built)

docker build \
  --build-arg BUILD_DATE="$(date -u +'%Y-%m-%dT%H:%M:%SZ')" \
  --build-arg COMMIT_SHA="$(git rev-parse HEAD 2>/dev/null || echo 'null')" \
  -t openconnect .

⁠Known issues

When running not in privileged mode, OpenConnect gives errors such as this:

Cannot open "/proc/sys/net/ipv4/route/flush"

This is normal and does not impact the operation of the VPN.

To suppress these errors, run with --privileged.