Permissions

The container runs OpenVPN as a dedicated nordvpn user and group. You can control the UID and GID of this user with environment variables.

Environment Variables

Variable	Default	Description
PUID	912	User ID for the nordvpn user
PGID	912	Group ID for the nordvpn group

When You Need This

If you mount host volumes into containers that share the VPN's network namespace, OpenVPN (running as UID 912) may not have permission to read/write those files. Setting PUID and PGID to match your host user avoids permission issues.

Finding Your Host UID/GID

id -u    # your UID
id -g    # your GID

Usage

docker run -d --cap-add=NET_ADMIN --device /dev/net/tun \
           -e USER=service_username -e PASS=service_password \
           -e PUID=1000 -e PGID=1000 \
           azinchen/nordvpn

Docker Compose

services:
  vpn:
    image: azinchen/nordvpn:latest
    cap_add:
      - NET_ADMIN
    devices:
      - /dev/net/tun
    environment:
      - USER=service_username
      - PASS=service_password
      - PUID=1000
      - PGID=1000

How It Works

During container startup, the init-adduser service:

1. Checks the current UID/GID of the nordvpn user
2. If they don't match PUID/PGID, updates them with usermod/groupmod
3. The credentials file (/run/xt/auth) is then created with ownership set to nordvpn:nordvpn

This runs before OpenVPN starts, so the VPN process inherits the correct identity.