teodornasu/openvpn-alpine repository overview

⁠Lightweight OpenVPN Server (Community Edition)

This is a lightweight OpenVPN Community Edition server image. It comes with an uninitialized Public Key Infrastructure (PKI), giving you complete control over your certificate management and initial setup.

⁠How to Use This Image

Because the PKI is uninitialized, setting up the server requires a one-time manual configuration before it can run automatically.

⁠Step 1: Start the container for initialization

To begin, you need to keep the container awake without starting the OpenVPN daemon. You do this by overriding the default command with sleep infinity.

Important: You must mount a volume (or a local host directory) to /etc/openvpn so your generated PKI and configuration files are permanently saved.

docker run -d \
  --name openvpn-init \
  -v openvpn_data:/etc/openvpn \
  teodornasu/openvpn-alpine:latest sleep infinity

(Note: Replace openvpn_data with a local path like /my/local/path:/etc/openvpn if you prefer bind mounts).

⁠Step 2: Build the PKI

Once the container is running in sleep mode, open an interactive shell inside it to set up your keys:

docker exec -it openvpn-init /bin/sh

Inside the container, copy the easy-rsa binaries to your persistent directory and start building your PKI:

# Copy easyrsa binaries to the persistent OpenVPN directory
cp -r /usr/share/rasy-rsa/* /etc/openvpn/

# Navigate to the directory and run your PKI generation commands
cd /etc/openvpn
# (e.g., ./easyrsa init-pki, ./easyrsa build-ca, etc.)

⁠Step 3: Add your server configuration

To enable automatic starts, the server requires a configuration file (e.g., server.ovpn). Place your completed configuration file into the /etc/openvpn directory. Because you mounted this directory in Step 1, you can also drop this file directly into the corresponding folder on your host machine.

⁠Step 4: Run the server normally

Once your PKI is fully generated and your configuration file is in place, you can stop and clean up the initialization container:

docker rm -f openvpn-init

Now, launch the server normally without the sleep infinity command. It will automatically detect the configuration in /etc/openvpn and start the service:

docker run -d \
  --name openvpn-server \
  --cap-add=NET_ADMIN \
  -p 1194:1194/udp \
  -v openvpn_data:/etc/openvpn \
  teodornasu/openvpn-alpine:latest

(Note: OpenVPN typically requires the --cap-add=NET_ADMIN flag and port 1194 exposed to route traffic properly).