Stopped working recently - now needs explicit access to /dev/net/tun device?

[airdrummingfool]

This image stopped working for me about 3 weeks ago. My guess is that I updated the host Docker software and it increased security restrictions on the container, but I'm not sure.

Whatever happened, the outcome was that I could no longer connect to Windscribe. The logs weren't much help:

windscribe-1  | spawn windscribe connect best
windscribe-1  | Connecting to US Central Kansas City Glinda (tcp:80)
windscribe-1  | Firewall Enabled
windscribe-1  | Failed to connect, retrying

Looking into the windscribe debug logs (windscribe viewlog in the container) showed multiple odd errors about failing to connect to the VPN management interface, but one stood out to me:

ERROR: Cannot open TUN/TAP dev /dev/net/tun: Operation not permitted (errno=1)

It seemed like the container didn't have access to /dev/net/tun anymore. I added the following to the windscribe entry in my docker-compose.yml file to explicitly give it access:

    devices:
      - /dev/net/tun:/dev/net/tun

I also tested adding privileged: true instead, which worked; but I'd prefer to keep permissions to a minimum.

Anyways, this is just a heads up for anyone using this container that hasn't been able to connect recently. It seems like a recent Docker update might have tightened security a bit and the container might now need explicit access to the /dev/net/tun device.

[jmichler]

Hi,
docker run -d --restart always --name windscribe --cap-add NET_ADMIN -v /home/pi/windscribe-startup.sh:/opt/scripts/app-startup.sh --device /dev/net/tun -e PUID=1000 -e PGID=1000 -e WINDSCRIBE_USERNAME=xxx -e WINDSCRIBE_PASSWORD=yyyy -e WINDSCRIBE_LOCATION=DE -e WINDSCRIBE_PORT_FORWARD=9999 -e WINDSCRIBE_PORT=80 -e VPN_PORT=8080 --dns 8.8.8.8 myself/docker-windscribe

this worked for me on the first start of the container. However if I do a docker restart of the container I get errors regarding "temporary issues with name resolution". This worked before as well and seems to got broken with those changes here; does this work for you?

[airdrummingfool]

@jmichler When I restart my windscribe container, it immediately reconnects without any issues. It's worth noting that I am running windscribe via docker compose - not docker run - though I'm not sure why that would make a difference.

If I recall correctly, I saw some "temporary issues with name resolution" errors in the log before I added in the mapping for the /dev/net/tun device. Perhaps restarting your container is somehow causing it to lose access to the device? I'd suggest checking the windscribe service logs (windscribe viewlog in the running container) and seeing if anything stands out.