[{"_1":2,"_174":-5,"_175":-5},"loaderData",{"_3":4,"_17":18,"_25":26,"_151":152},"root",{"_5":-5,"_6":-7,"_7":8,"_9":-7,"_10":11,"_12":-7,"_13":14,"_15":16},"currentUser","primaryEmail","siteVerification","6LeIxAcTAAAAAJcZVRqyHh71UMIEGNQ_MXjiZKhI","toast","enableDev",false,"incidentStatus","theme","system","contrast","normal","routes/_layout",{"_19":-5,"_20":21,"_22":21,"_23":11,"_24":21},"username","isAskGordonEnabled",true,"isUsingNewTemplate","showMinimalLanding","showHoneypotTrap","routes/_layout.r.$namespace.$reponame",{"_27":28,"_29":-5,"_30":11,"_31":11,"_32":33,"_34":35,"_36":-5,"_37":11,"_38":39,"_88":-5,"_89":90,"_140":-5,"_141":11,"_142":21,"_143":11,"_144":-5,"_145":11,"_146":-5,"_147":148,"_149":91,"_150":-7},"canonicalUrl","https://hub.docker.com/r/luciusm/ssh-tunnel/tags","mcpServer","canSeeDockerfile","canSeeAutobuilds","namespace","luciusm","reponame","ssh-tunnel","cloudBuildSource","isAutobuildsAvailable","repo",{"_40":41,"_42":43,"_45":46,"_47":48,"_49":11,"_50":51,"_52":53,"_54":55,"_57":35,"_32":33,"_58":59,"_60":44,"_61":62,"_63":64,"_65":66,"_67":-5,"_68":62,"_69":70,"_71":11,"_72":33,"_73":74,"_79":11,"_80":81,"_85":33,"_86":87},"categories",[],"content_types",[44],"image","date_registered","2021-02-15T19:08:53.455845Z","description","","is_private","last_updated","2021-02-16T02:33:09.173716Z","last_modified","2024-10-16T13:48:34.145251Z","media_types",[56],"application/vnd.docker.distribution.manifest.list.v2+json","name","pull_count",452,"repository_type","star_count",0,"status",1,"status_description","active","source","collaborator_count","full_description","Container image for local ssh tunneling into firewall-protected servers\n====\n\n## Basic idea\n\nIn many scenarios, the ssh server of a campus computer or HPC cluster\nis protected by firewalls, requiring VPN on the client side. It become\nimpractical if the client needs to connect to multiple such servers,\nsince by default the VPN softwares renders global network traffic.\n\nThe `ssh-tunnel` image provides an approach to circumvent such\nsituation, by setting up individual containers as OpenSSH-server with\nindividual VPN environments, for example:\n\n- Client --ssh--> [container-1, VPN-1, port: 2222] --ssh--> [protected server-1, port: 22]\n- Client --ssh--> [container-2, VPN-2, port: 3333] --ssh--> [protected server-2, port: 22]\n\nOn the client side, the host computer does not interfere with the VPN\ninterface at all. Such settings can be quite useful if the user is\ncontrolling several firewall-protected servers for HPC calculations or supervision.\n\nThe image is based on `ghcr.io/linuxserver/openssh-server`. Currently\nusing [`openconnect`](https://www.infradead.org/openconnect/) as the\nVPN client since most campus VPN are using Cisco SSL VPN. More to be\nadded if necessary\n\n\n## Usage\n\nBasically, use the following steps for ssh-tunneling:\n1. Start the `ssh-tunnel` image in daemon mode, with proper VPN settings\n2. ssh into the protect server by the ssh proxy server\n\nFor best practice, prepare the following files:\n- A pair of keys for your local machine (e.g. `~/.ssh/id_rsa.pub` and\n `~/.ssh/id_rsa` generated by `ssh-keygen`) for password-less\n authentication into the containers\n- SSH-host-key pairs (e.g. `ssh_host_rsa_key` etc.) for fingerprints\n on the container if you want to avoid the ` WARNING: REMOTE HOST\n IDENTIFICATION HAS CHANGED! ` error. Place all the key pairs under\n one folder (e.g. `~/ssh_host_keys`)\n- Necessary authentication files for the firewall-protected server,\n e.g. the private key.\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n### Start the daemon container\n\nUse `docker-cli`\n\n```\ndocker run -d \\\n --cap-add NET_ADMIN `#Need NET_ADMIN privilege for networking`\\\n --name=ssh-tunnel-vpn0 \\\n -p 3333:2222 `#3333 is the ssh tunnel port on your localhost`\\\n -v /path/to/host_key_files:/config/ssh_host_keys `#if you want to fix ssh-keys`\\\n -e PUBLIC_KEY=\"$(cat ~/.ssh/id_rsa.pub)\" `#change if using other public keys`\\\n -e OPENCONNECT_USERNAME=\"abc@campus.edu\" `#change accordingly`\\\n -e OPENCONNECT_SERVER=\"vpn.campus.edu\" `#change accordingly`\\\n -e OPENCONNECT_PW=\"Some password\" `#VPN password, cat from a password file if necessary`\\\n --restart unless-stopped \\\n luciusm/ssh-tunnel\n```\n\nMost of the parameters can be refered to the\n[`linuxserver/openssh-server`](https://github.com/linuxserver/docker-openssh-server)\nimage.\n\nAlternatively, password variables can be set using file secrets by\nprepending `FILE__`, e.g.\n\n```\n-e FILE__OPENCONNECT_PW=/run/secrets/vpnpasswd\n```\nif the `/run/secrets/vpnpasswd` is mounted\n\n### SSH proxy connection\n\nFor the first time use, it's better to test if the VPN actually works\ninside the container. While the daemon container is running, execute\nthe ssh connection inside the container:\n```sh\n# Change the container name according to your case\ndocker exec ssh-tunnel-vpn0 ssh @\n```\nFor troublingshooting, check if `sshd` and `openconnect` are running in the container. Make sure the line\n```\nAllowTcpForwarding yes\n```\nis present in the `/etc/ssh/sshd_config` file.\n\nThen the actual ssh tunneling stuff:\n```sh\nssh -o ProxyCommand=\"ssh -W %h:%p -p -i ssh-user@localhost\" @\n```\n- For `` and `` please see the previous step of running container\n- `ssh-user` is the default user in the container. If you have the\n same username on localhost, remember to specify via `-e\n USER_NAME=` when starting the container.\n\nIf everything's fine now you should have access to the protected\nserver\n","has_starred","hub_user","immutable_tags_settings",{"_75":11,"_76":77},"enabled","rules",[78],".*","is_automated","permissions",{"_82":21,"_83":11,"_84":11},"read","write","admin","user","storage_size",74360467,"orgData","recentTags",[91],{"_92":44,"_93":94,"_95":96,"_97":98,"_99":100,"_50":129,"_130":94,"_131":33,"_132":56,"_57":133,"_134":135,"_136":108,"_137":129,"_138":66,"_139":21},"content_type","creator",9456337,"full_size",20502219,"id",137648385,"images",[101,118,124],{"_102":103,"_104":105,"_106":48,"_107":108,"_109":110,"_111":112,"_113":48,"_114":-5,"_115":116,"_63":66,"_117":-5},"architecture","amd64","digest","sha256:4df52ebb2f7737f3d325bd8fc5ca02427a13cb59a5a555c93d625992042feea0","features","last_pulled","2026-09-23T01:02:49.481770485Z","last_pushed","2021-02-15T23:46:51Z","os","linux","os_features","os_version","size",20112917,"variant",{"_102":119,"_104":120,"_106":48,"_107":121,"_109":122,"_111":112,"_113":48,"_114":-5,"_115":123,"_63":66,"_117":-5},"arm64","sha256:864dbfac1133374420bb7b0ad2f845d07d1439bf40bdad3761f9a9cae6f469c5","2026-09-09T16:46:06.807186Z","2021-02-15T23:46:50Z",22412812,{"_102":125,"_104":126,"_106":48,"_107":127,"_109":122,"_111":112,"_113":48,"_114":-5,"_115":96,"_63":66,"_117":128},"arm","sha256:61436f476d8752d0e7f4456122905c2bce25c6c72f4a06bafcf97304e8c708bd","2026-09-09T16:46:06.829391658Z","v7","2021-02-16T02:33:08.556593Z","last_updater","last_updater_username","media_type","latest","repository",11425867,"tag_last_pulled","tag_last_pushed","tag_status","v2","sbxKitMetadata","isPotentialSpam","isHubSbxKitsEnabled","showSbxLogoOverride","sbxTrademarkText","displaySecurityMetadata","tagAttestations","tagsHaveAttestations",[],"selectedTag","attestationsUrl","routes/_layout.r.$namespace.$reponame.tags",{"_38":153,"_160":161,"_147":172,"_173":11},{"_40":154,"_42":155,"_45":46,"_47":48,"_49":11,"_50":51,"_52":53,"_54":156,"_57":35,"_32":33,"_58":59,"_60":44,"_61":62,"_63":64,"_65":66,"_67":-5,"_68":62,"_69":70,"_71":11,"_72":33,"_73":157,"_79":11,"_80":159,"_85":33,"_86":87},[],[44],[56],{"_75":11,"_76":158},[78],{"_82":21,"_83":11,"_84":11},"tags",{"_162":64,"_163":-5,"_164":-5,"_165":166},"count","next","previous","results",[167],{"_92":44,"_93":94,"_95":96,"_97":98,"_99":168,"_50":129,"_130":94,"_131":33,"_132":56,"_57":133,"_134":135,"_136":108,"_137":129,"_138":66,"_139":21},[169,170,171],{"_102":103,"_104":105,"_106":48,"_107":108,"_109":110,"_111":112,"_113":48,"_114":-5,"_115":116,"_63":66,"_117":-5},{"_102":119,"_104":120,"_106":48,"_107":121,"_109":122,"_111":112,"_113":48,"_114":-5,"_115":123,"_63":66,"_117":-5},{"_102":125,"_104":126,"_106":48,"_107":127,"_109":122,"_111":112,"_113":48,"_114":-5,"_115":96,"_63":66,"_117":128},[],"canDeleteTags","actionData","errors"]

Digest	OS/ARCH	Compressed size
4df52ebb2f77	linux/amd64	19.18 MB
61436f476d87	linux/arm/v7	19.55 MB
864dbfac1133	linux/arm64	21.37 MB

luciusm/ssh-tunnel

Tags for luciusm/ssh-tunnel