vm75/vpn-sandbox repository overview

⁠

VPN Sandbox routes container traffic through a configured OpenVPN or WireGuard tunnel and provides an optional web UI, HTTP proxy, and SOCKS5 proxy.

⁠Image

vm75/vpn-sandbox

The image is built from Containerfile⁠ and published to Docker Hub by the repository’s release workflow.

⁠Tags

• 0.2.0 — current full-version release tag.
• 0.2 and 0 — release aliases generated by the workflow.
• latest — current stable release.

Use a full version tag for reproducible deployments:

docker pull vm75/vpn-sandbox:0.2.0

⁠Run

Real VPN tunnel operation requires NET_ADMIN and /dev/net/tun:

docker run -d --name vpn-sandbox \
  --cap-add=NET_ADMIN \
  --device=/dev/net/tun \
  -p 8080:80 \
  -p 1080:1080 \
  -p 3128:3128 \
  -v /path/to/data:/data \
  vm75/vpn-sandbox:0.1.1

The management UI and API are exposed by container port 80. The optional SOCKS5 and HTTP proxies use ports 1080 and 3128.

The management API has no application authentication. Restrict published management and proxy ports to trusted networks.

⁠Ports and storage

Mount /data as persistent storage:

Do not publish or commit generated credentials, private keys, .auth files, or database copies.

⁠Platforms

The release workflow builds:

• linux/amd64

⁠Compose and local builds

For the project’s VPN plus FlareSolverr example, see compose.yml.example⁠ and README.md⁠. To build locally:

podman build -f Containerfile -t vm75/vpn-sandbox:local .

Docker-compatible builders can use the same Containerfile.

⁠Publishing

The GitHub Actions workflow runs on pushes to main that change CHANGELOG.md, and can also be started manually. It derives release tags from the first changelog heading, publishes version/major/minor aliases plus latest, and verifies the Docker Hub image. Publishing requires the repository’s configured DOCKER_USERNAME and DOCKER_PASSWORD secrets; their values are not stored in the repository.