Docker: privileged: true since v3.17

[edgd1er]

Since v3.17.0, in a container, nordvpn client has to be executed with higher rights in docker (priviledged: true), adding, admin, system, net caps didn't not help.
it seems that systctl values are changed during the connection to vpn servers, which is not possible in a container without the privileged mode.
Error when not in privileged mode:

nordlynx  | 2025/07/04 18:25:55 [Error] failed to connect to de970.nordvpn.com : setting rp filter: setting rp_filter: setting the value of 'net.ipv4.conf.all.rp_filter' to 2: setting net.ipv4.conf.all.rp_filter to 2: exit status 1: sysctl: permission denied on key "net.ipv4.conf.all.rp_filter"

As a result connection is lost and dns cannot resolve address anymore

nordlynx  | 2025/07/04 18:44:37 [Debug] notifying about data connect change event: {Status:{State:DISCONNECTED Technology:NORDLYNX Protocol:UDP IP:193.124.21.44 Name:Germany #1182 Hostname:de1182.nordvpn.com Country:Germany CountryCode:DE City:Frankfurt StartTime:<nil> IsVirtualLocation:false IsPostQuantum:false IsObfuscated:false TunnelName: IsMeshnetPeer:false Rx:0 Tx:0}}
nordlynx  | Connecting to Germany #1182 (de1182.nordvpn.com)
nordlynx  | The VPN connection has failed. Please check your internet connection and try connecting to the VPN again. If the issue persists, contact our customer support.'

Having set the systctl in docker compose, could the client just check that the proper value is set and continue processing the connection ?

[mariusSincovici]

Hi,

At the moment is not possible to disable that systctl execution. This is because we've saw that even when IPv6 is disabled and the correct value is set in the system, when adding a new interface(USB adapter) OS would ignore the setting and the new interface will have IPv6 assigned. To ensure there are no IPv6 leaks in the system, the application will set again the value when there are network changes detected.

The application doesn't set that value when it doesn't exist. For example IPv6 was disabled from GRUB. In that case the setting is not there so it will not do anything.

For docker it should work if is executed with --cap-add=NET_ADMIN. In this way the docker would have access to use sysctrl values. Did you've tried with this too?

Br

[edgd1er]

Thanks for the explanation.

Unfortunately, nothing I tried was sucessful:

• adding NET_RAW, NET_ADMIN, SYS_MODULE, SYS_ADMIN to the container: connection failed
• adding ALL to the container: connection failed
• create a user bridged network with ipv6 disabled failed:
  "Name": "nordlynx-proxy_lynx_net",
  "Id": "347878cd3cc28ec6a9a60bb63ce04990bfad892c85c7d3a9e246210c1e6275ef",
  "Created": "2025-07-04T22:51:07.572567508+02:00",
  "Scope": "local",
  "Driver": "bridge",
  "EnableIPv4": true,
  "EnableIPv6": false,
• adding a mix of NET_ADMIN and seccomp helped for setting net.conf.all.ipv4... :
  security_opt:
  - seccomp=unconfined
  - systempaths=unconfined
  cap_add:
  - NET_ADMIN
  - SYS_ADMIN
  - SYS_MODULE

then changing routing rules failed:
nordlynx | 2025/07/04 23:56:18 [Info] Setting the routing rules up
nordlynx | 2025/07/04 23:56:18 [Warning] removing suppress prefix rule: no such file or directory
nordlynx | 2025/07/04 23:56:18 [Warning] removing fwmark rule: no such file or directory
nordlynx | 2025/07/04 23:56:18 [Warning] removing suppress prefix rule: no such file or directory
nordlynx | 2025/07/04 23:56:18 [Warning] removing fwmark rule: no such file or directory
nordlynx | 2025/07/04 23:56:18 [Defer] unsetting ifgroups: not set
nordlynx | 2025/07/04 23:56:18 [Info] TELIO(v5.4.0): ThreadId(13) "telio::ffi":711 Telio::disconnect_from_exit_nodes entry with instance id: 1738935536511063806.

Something seems to require more access than all capabilities are giving, running in privileged mode is at the moment the only solution.

[mariusSincovici]

Hi,

Would it be possible to send a the file or a sample for docker how you try to use, so we can also try?

I only tried with docker image, like in the tutorial, and in this case --cap-add=NET_ADMIN solve the problem.

Thanks

[edgd1er]

Hi,

the image is: edgd1er/nordlynx-proxy:latest based on this repo: https://github.com/edgd1er/nordlynx-proxy/

This "template" compose file has everything needed to start.
you may comment privileged: true and add a file nordvpn_creds containing a token or a username/password

[mariusSincovici]

Hi,

Did you've tried to use as base image Ubuntu instead of Debian, at least just for testing?

I've just saw that with Ubuntu:24.04 I'm able to run the docker image without the --privileged and I can connect to VPN, but not with Debian. In Debian I get the sysctl error, but not with Ubuntu.

[edgd1er]

Hi,

Thanks for your input.
I thought that ubuntu being based on debian, there was no such big differences especially in system and kernel features.
I was wrong, first tests with ubuntu 24.04 are running ok.
Thanks, I guess i'll have to switch ma base image and rework a bit the dockerfile ;)

if it's ok with you, you may close the issue.
If ever you have a chance to find out why is debian so different from ubuntu concerning this settings, I would be glad to learn about it.
Do you debian users contacting the support about higher privileges requested by nordvpn's client ?