Docker-compose.yml and Version 3.7 dont support cap_add

[iluvatyr]

Hello,
I have following question/issue.

From what I read, to be able to use docker secrets, it is necessary to be in swarm mode.
For swarm mode, the version in the docker-compose.yml has to be atleast 3.
In the docker-compose.yml provided within this repository (LINK), the version number is 3.7 and it uses docker secrets. It also includes the line:

cap_add:
     -  NET_ADMIN

but from what I have read, it is not possible to use this in version 3.7. I have also tried to do it, but the container doesnt receive the privilege it needs and shuts down. So in conclusion, because of this , it is not possible for me to use docker secrets. What are you doing to do this? Here are the logs:

Running version latest built on 2021-05-23T21:55:31Z (commit 0c4f01a)
🔧  Need help? https://github.com/qdm12/gluetun/issues/new
💻  Email? [email protected]
☕  Slack? Join from the Slack button on Github
💸  Help me? https://github.com/sponsors/qdm12
2021/05/25 20:53:15 INFO Alpine version: 3.13.5
2021/05/25 20:53:15 INFO OpenVPN version: 2.5.2
2021/05/25 20:53:15 INFO Unbound version: 1.13.0
2021/05/25 20:53:15 INFO IPtables version: v1.8.6
2021/05/25 20:53:15 INFO Settings summary below:
|--OpenVPN:
   |--Verbosity level: 1
   |--Run as root: enabled
   |--Custom cipher: aes-256-cbc
   |--Custom auth algorithm: sha512
   |--Custom configuration: /gluetun/custom.conf
   |--Provider:
      |--Nordvpn settings:
         |--Network protocol: udp
|--DNS:
   |--Plaintext address: 103.86.99.100
   |--DNS over TLS:
      |--Unbound:
          |--DNS over TLS providers:
              |--Cloudflare
          |--Listening port: 53
          |--Access control:
              |--Allowed:
                  |--0.0.0.0/0
                  |--::/0
          |--Caching: enabled
          |--IPv4 resolution: enabled
          |--IPv6 resolution: disabled
          |--Verbosity level: 1/5
          |--Verbosity details level: 0/4
          |--Validation log level: 0/2
          |--Username: 
      |--Blacklist:
         |--Blocked categories: malicious
         |--Additional IP networks blocked: 13
      |--Update: every 24h0m0s
|--Firewall:
|--System:
   |--Process user ID: 998
   |--Process group ID: 100
   |--Timezone: europe/berlin
|--HTTP control server:
   |--Listening port: 8000
   |--Logging: enabled
|--Public IP getter:
   |--Fetch period: 12h0m0s
   |--IP file: /tmp/gluetun/ip
|--Github version information: enabled
2021/05/25 20:53:15 INFO storage: merging by most recent 9097 hardcoded servers and 9097 servers read from /gluetun/servers.json
2021/05/25 20:53:15 INFO routing: default route found: interface eth2, gateway 172.19.0.1
2021/05/25 20:53:15 INFO routing: local ethernet link found: eth1
2021/05/25 20:53:15 INFO routing: local ethernet link found: eth2
2021/05/25 20:53:15 INFO routing: local ethernet link found: eth0
2021/05/25 20:53:15 INFO routing: local ipnet found: 10.0.0.0/24
2021/05/25 20:53:15 INFO routing: local ipnet found: 10.0.9.0/24
2021/05/25 20:53:15 INFO routing: local ipnet found: 172.19.0.0/16
2021/05/25 20:53:15 INFO routing: default route found: interface eth2, gateway 172.19.0.1
2021/05/25 20:53:15 WARN 💡 Tip: Are you passing NET_ADMIN capability to gluetun?
2021/05/25 20:53:15 ERROR cannot setup routing: cannot add IP rule: cannot add routing rule: for rule "ip rule 100: from 172.19.0.5/32 table 200": operation not permitted
2021/05/25 20:53:15 INFO Shutdown successful

and here the yml i used:

---
version: '3.7'
services:
  gluetun:
    image: qmcgaw/gluetun
    container_name: gluetun
    environment:
      - PUID=998
      - PGID=100
      - DNS_PLAINTEXT_ADDRESS=103.86.99.100
      - OPENVPN_CIPHER=aes-256-cbc
      - OPENVPN_AUTH=sha512
      - OPENVPN_CUSTOM_CONFIG=/gluetun/custom.conf
      - OPENVPN_IPV6=off
      - VPNSP=NordVPN
      - TZ=Europe/Berlin
    volumes:
      - /srv/dev-disk-by-label-Data/Config/Gluetun2/:/gluetun
      - /srv/dev-disk-by-label-Data/Config/Gluetun2/nl884.nordvpn.com.udp.ovpn:/gluetun/custom.conf
    ports:
      - 8388:8388 #Shadowsocks
    cap_add:
      - NET_ADMIN
    secrets:
      - openvpn_user
      - openvpn_password
    restart: unless-stopped    
secrets:
  openvpn_user:
    external: true
  openvpn_password:
    external: true

[qdm12]

You can use docker-compose for it. Not sure which version, I use 3.8 but it might be possible with < 3.8.

That's my config:

version: "3.8"
services:
  gluetunnyc:
    image: qmcgaw/gluetun
    cap_add:
      - NET_ADMIN
    volumes:
      - gluetun:/gluetun
    secrets:
      - openvpn_user
      - openvpn_password

secrets:
  openvpn_user:
    file: ./openvpn_user
  openvpn_password:
    file: ./openvpn_password

[qdm12]

Just tried and it works with 3.7 as well 😉

[iluvatyr]

yeah it works with your configuration. Alright, but I had to disable the swarm mode. If in swarm mode, it doesnt work. So its not possible to use external secrets. Thanks for the answer.

[qdm12]

Also gluetun reads from /run/secrets/ inside the container, it doesn't really care how you mount them. There is probably a way to mount them as such with Swarm, but I didn't try or search. But if you're happy with docker-compose, stick to it 😉

Also Swarm is being pushed to EOL so you may want to switch to (albeit a bit overkill) Kubernetes instead.