vcybertech/vpnctl repository overview

⁠vpnctl

VPN lifecycle management for CI/CD runners.

Establishes a VPN tunnel and verifies it is actually functional — using a real TCP health check, not a sleep.

This is the Docker distribution channel for the vpnctl binary. It's the same tool that powers the vpn-setup-action⁠ and vpn-teardown-action⁠ GitHub Actions.

⁠Usage

docker pull docker.io/vcybertech/vpnctl:1

The container needs host networking and permission to create the tunnel interface:

docker run --rm \
    --network=host \
    --cap-add=NET_ADMIN \
    -e RUNNER_TEMP=/work \
    -v /path/config.ovpn:/input/config.ovpn:ro \
    -v /tmp/vpn-work:/work \
    docker.io/vcybertech/vpnctl:1 \
    conectar --config /input/config.ovpn \
             --healthcheck-host internal.dns.example --healthcheck-port 53

Required flags:

• --network=host — without this, the tunnel is isolated inside the container namespace and the host cannot see the tun interface
• --cap-add=NET_ADMIN — without this, openvpn cannot create the interface
• -e RUNNER_TEMP=/work + volume — so desconectar can find the PID file

⁠Tags

⁠Source

Full source code, tests and documentation: https://github.com/vcyber-tech/actions-rust⁠

⁠Security notes

⁠CVE-2026-11604

The Docker Hub scanner may flag CVE-2026-11604 for the openvpn package. This CVE affects ovpn-dco-win, the Windows-specific DCO driver. The component is not present in the Linux/Alpine build, so this image is not affected. See the Alpine security tracker⁠ for details.

⁠License

MIT