sando38/docker-eturnal repository overview

⁠The image is now maintained in the official > eturnal github repository⁠ <

This repository is archieved.

Latest trivy image scan result from the latest image sando38/docker-eturnal:v1.8.3-4 hosted on DockerHub:

root@arm64:/home# trivy image sando38/docker-eturnal:v1.8.3-4
2022-05-30T19:34:02.179+0100    INFO    Need to update DB
2022-05-30T19:34:02.179+0100    INFO    DB Repository: ghcr.io/aquasecurity/trivy-db
2022-05-30T19:34:02.179+0100    INFO    Downloading DB...
32.11 MiB / 32.11 MiB [------------------------------------------] 100.00% 3.80 MiB p/s 8.6s
2022-05-30T19:34:16.396+0100    INFO    Detected OS: alpine
2022-05-30T19:34:16.397+0100    INFO    This OS version is not on the EOL list: alpine 3.16
2022-05-30T19:34:16.398+0100    INFO    Detecting Alpine vulnerabilities...
2022-05-30T19:34:16.401+0100    INFO    Number of language-specific files: 0

sando38/docker-eturnal:v1.8.3-4 (alpine 3.16.0)

Total: 0 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 0, CRITICAL: 0)

⁠Docker image for eturnal STUN/TURN server

This is a multi-arch eturnal⁠ docker image, currently built for

• linux/amd64,
• linux/386,
• linux/s390x,
• linux/ppc64le,
• linux/arm64,
• linux/arm/v7,
• linux/arm/v6

and based on Alpine Linux.

⁠Usage

To pull the image, just refer to the Docker Hub repository:

docker pull sando38/docker-eturnal

The image will run in eturnal foreground mode, if started this way:

docker run -d sando38/docker-eturnal:latest

The image can also run in a less "privileged" mode:

docker run -d \
  --name eturnal \
  --user 9000:9000 \
  -v /path/to/eturnal.yml:/opt/eturnal/etc/eturnal.yml \
  -p 3478:3478/udp \
  -p 49152-65535:49152-65535/udp \
  --read-only \
  --security-opt no-new-privileges \
  --cap-drop=ALL \
  sando38/docker-eturnal:latest

As an alternative since docker performs badly with large port ranges⁠ with using the host network --network=host. Please note, that the docker container is not isolated from the host network anymore when using this option.

docker run -d \
  --name eturnal \
  --user 9000:9000 \
  -v /path/to/eturnal.yml:/opt/eturnal/etc/eturnal.yml \
  --network=host \
  --read-only \
  --security-opt no-new-privileges \
  --cap-drop=ALL \
  sando38/docker-eturnal:latest

NOTE: When running --network=host or similarly with network_mode: "host" in compose or hostNetwork: true in kubernetes, consider to set ERL_EPMD_ADDRESS=127.0.0.1 to not publish the EPMD daemon (default port 4369) to the outside world.

Inspect the running container with

docker logs < container name >

Note: for logs to be printed with docker logs command, log_dir: in eturnal.yml should be set to stdout.

To use the eturnalctl command⁠, e.g. just run:

docker exec < container name > eturnalctl info

⁠Tags

vXX.YY.ZZ represents the official eturnal release. -AA suffix for image version of the particular release in case of any bug fix, etc. of the image.

⁠Configuration

Configuration is mainly done by the mounted eturnal.yml file (recommended). Here is an example eturnal.yml⁠ file. However, eturnal may also be configured with some environment variables (see eturnal documentation⁠).

The configuration file is best mounted directly into the container:

Mountpath: -v /path/to/eturnal.yml:/opt/eturnal/etc/eturnal.yml

Here are some more hints how to configure eturnal⁠.

⁠Volume mounts

Volumes may be mounted for the configuration file and tls certificates/ dh-parameter file. TLS certificates and dh-parameter file shall be .pem files.

volumes:
  - /path/to/eturnal.yml:/opt/eturnal/etc/eturnal.yml  # for (custom) configuration file
  - /path/to/cert-files:/opt/eturnal/tls               # for tls certicates

TLS certificates must be readable by eturnal user/ group 9000:9000 and should not have world readable access rights (chmod 400).

⁠Readonly file system & .erlang.cookie file (only relevant for tag v1.8.3)

If you want to use a readonly file system (--read-only, in compose read_only: true or in kubernetes' securityContext, readOnlyRootFilesystem: true), the .erlang.cookie file must be mounted with the correct permissions (owned (chown 9000:9000) and readonly (chmod 400) by eturnal user) into the container.

Here is a quick checklist:

• Create cookie with correct read-only permissions (chmod 0400) and owner 9000:9000
  • echo "My1-ErlanG2-CookiE3" > /path/to/COOKIE
• Mount cookie to: -v /path/to/COOKIE:/opt/eturnal/.erlang.cookie

For kubernetes an initContainers may be used to achieve the correct file permissions.