benyoo/ocserv repository overview

⁠Docker OpenConnect

Lightweight ocserv container image for OpenConnect / AnyConnect compatible VPN deployments.

⁠Features

• Based on CentOS Stream 9
• ocserv server with supervisord process management
• Auto-generated runtime config from environment variables
• Built-in healthcheck
• Built-in file watcher and config reload flow
• Optional Telegram notifications
• Optional Google Authenticator support
• Optional server-side ACL sync support
• Persistent data layout for certificates, users, logs, and runtime state

⁠Requirements

• Docker Engine or Docker Compose v2
• /dev/net/tun available on host
• Container started with NET_ADMIN
• TCP/UDP port 443 exposed

⁠Quick Start

Create host directories:

mkdir -p /data/ocserv/etc /data/ocserv/{users,certs,logs,state} /data/ocserv/run

Run the container:

docker run -d \
  --name ocserv_server \
  --restart unless-stopped \
  --cap-add NET_ADMIN \
  --device /dev/net/tun:/dev/net/tun \
  -p 443:443/tcp \
  -p 443:443/udp \
  -e TZ=Asia/Shanghai \
  -e OC_AUTH_MODE=plain \
  -e OC_PASSWD_FILE=/data/ocserv/users/ocpasswd \
  -e OC_IPV4_NETWORK=10.20.30.0 \
  -e OC_IPV4_NETMASK=255.255.255.0 \
  -e OC_DNS=1.1.1.1,9.9.9.9 \
  -v /data/ocserv/etc:/etc/ocserv \
  -v /data/ocserv:/data/ocserv \
  -v /data/ocserv/run:/run/ocserv \
  benyoo/ocserv:9-stream-1.4.1-1-20260408

⁠Docker Compose Example

services:
  ocserv:
    image: benyoo/ocserv:9-stream-1.4.1-1-20260408
    container_name: ocserv_server
    restart: unless-stopped
    cap_add:
      - NET_ADMIN
    devices:
      - /dev/net/tun:/dev/net/tun
    ports:
      - "443:443/tcp"
      - "443:443/udp"
    environment:
      TZ: Asia/Shanghai
      OC_AUTH_MODE: plain
      OC_PASSWD_FILE: /data/ocserv/users/ocpasswd
      OC_IPV4_NETWORK: 10.20.30.0
      OC_IPV4_NETMASK: 255.255.255.0
      OC_DNS: 1.1.1.1,9.9.9.9
    volumes:
      - /data/ocserv/etc:/etc/ocserv
      - /data/ocserv:/data/ocserv
      - /data/ocserv/run:/run/ocserv

⁠Persistent Paths

• /etc/ocserv
• /data/ocserv
• /run/ocserv

Recommended subdirectories under /data/ocserv:

• users
• certs
• logs
• state

⁠Certificates

Expected certificate paths:

• /data/ocserv/certs/server-cert.pem
• /data/ocserv/certs/server-key.pem

Optional:

• /data/ocserv/certs/ca.pem
• /data/ocserv/certs/crl.pem

If no certificate is provided and OC_AUTO_GEN_CERT=true, the container can generate a self-signed certificate on first start.

⁠Common Environment Variables

• OC_AUTH_MODE
• OC_PASSWD_FILE
• OC_TCP_PORT
• OC_UDP_PORT
• OC_IPV4_NETWORK
• OC_IPV4_NETMASK
• OC_DNS
• OC_SERVER_CERT
• OC_SERVER_KEY
• OC_CA_CERT
• OC_CRL_FILE
• OC_TELEGRAM_ENABLE
• OC_ACL_ENABLE

⁠Healthcheck

The image includes a built-in healthcheck script:

/app/scripts/healthcheck.sh

⁠Check Online Sessions

docker exec -it ocserv_server occtl-show-users
docker exec -it ocserv_server occtl-show-users --json

⁠Image Version Labels

The image can include detected ocserv RPM metadata in labels:

• org.opencontainers.image.version
• io.benyoo.ocserv.rpm-package
• io.benyoo.ocserv.rpm-version
• io.benyoo.ocserv.rpm-release
• io.benyoo.ocserv.rpm-version-short

Inspect them with:

docker image inspect benyoo/ocserv:latest --format '{{ json .Config.Labels }}'

⁠变量作用对照表

⁠Notes

• This image is intended for Linux hosts with TUN support.
• ocserv control socket discovery is handled automatically.
• For full deployment, advanced ACL, Telegram, PAM, and build instructions, use the repository README.