Connecting to containers that are using the gluetun container network

[bhj16]

Hi there, another question has cropped up :)

When i have a container within a docker-compose using:

network_mode: "service:gluetun"

I can't resolve the hostname [containername] from within my stack on the compose network [compose_network_a]. This makes sense to me, as gluetun is on the bridge network and I'm telling [containername] to use gluetun. The address isn't local anymore.

I have some applications running where I need to resolve an ip or hostname for the container that is using gluetun. Prior to this configuration I'd use [containername]:port, but I can't seem to find a way of finding this container as when using inspect, it doesn't have an ip (I assume it's IP is the same as the gluetun container on 10.0.3.2 or whatever?).

My docker networking knowledge is on shaky ground as it is, so I'm wondering if I'm going about this the right way?

Running docker exec -it [containername] getent hosts lists 10.0.3.2 as an ip, but since I'm trying to access a specific port I'm wondering if gluetun can handle this?

Should also be noted that I can access the running container just fine from outside the docker network @ [hostip]:port

Thanks!

[qdm12]

The containername and gluetun are the same host, so you need to use gluetun_name:port from your other container if I understood correctly.

[Raph521]

Could it be that DNS_KEEP_NAMESERVER=on is necessary? I saw that mentioned in another issue, but I wasn't sure what exactly it's used for 😊

[bhj16]

I have a caddy container in the stack and I cannot resolve gluentun_name from there. I can resolve the reported ip though. That made sense to me as the rest of the compose stack is on another network?

Thanks Raph, would DNS_KEEP_NAMESERVER=on be required on the gluetun or other container?

[qdm12]

DNS_KEEP_NAMESERVER is used to be able to resolve container names from within gluetun, not the opposite. You should leave it off otherwise to use DNS over TLS, as for now it's one or the other unfortunately.

If Caddy and gluetun are on two different docker networks, you won't be able to resolve gluetun from Caddy but that's valid for all containers. Maybe create a docker network docker create network and use that network for both your docker-compose.yml?

[qdm12]

Hi there, did this resolve your issue? Thanks!

[evil-p-anda]

@qdm12 From what I can gather I might be trying to do a similar thing and can't figure it out - I run a bunch of containers on a cloned bridge network and use the linuxserver/swag container so I can resolve domains on my LAN (eg. container.landomain.com), but when I have services routed through gluetun they won't resolve on the cloned network (only via bridge ip:port).

I have gluetun on the clone network as well. Is there something I need to set with Custom iptables rules? Not sure how to implement that either.

[qdm12]

If other containers use the network stack of gluetun (with network_mode=container:gluetn for example), you can only reach them by using the gluetun hostname as they are all on the same "host". So I would guess in your case, just use gluetun.landomain.com with the right port. It's a limitation of how Docker networking works, but if you really want to use a name for each service, you could always have a reverse proxy in front of your services, for example I have myservice.landomain.com pointing to gluetun:9090 and I can thus access it through http://myservice.landomain.com.

[evil-p-anda]

The linuxserver/swag container is a reverse proxy, but for some reason any containers that are routed through gluetun will not resolve, but will show if I use ip:port. Gluetun is also on the same docker network as the reverse proxy, so they should share the same ip?

[qdm12]

No, any service using the network stack of gluetun is under the gluetun host.

If you have:

• serviceA listening on port 4444 connected to gluetun
• gluetun in the same docker network as swag

You can reach serviceA using:

• gluetun:4444
• If gluetun has the domain name gluetun.localdomain.lan then you can use gluetun.localdomain.lan:4444
• On some reverse proxies (maybe swag, not sure) you can proxy for example serviceA.localdomain.lan to gluetun:4444 such that you don't need to specify the port.

[Manfred73]

I just recently started using gluetun. Before I had an external network bridge and my containers (in separate compose files) pointed to that external network, so all containers were using that network. Then in Radarr I could just setup my deluge and sabnzb clients and also the indexers by using their container name and port number, e.g. deluge:8112.
This no longer seems to work when using gluetun.

I still have separate compose files for all my containers which use the gluetun network:

 network_mode: "container:gluetun"

I tried connecting to deluge client from radarr by using gluetun:8112, but that doesn't work. When I use the ip address of the gluetun container, e.g. 172.29.28.2:8112 the connection seems to work. Both Radarr and Deluge are using network_mode: "container:gluetun" so as I understand they're both in the same network?
I could use the ip, but does this change if for example a new version of container is installed by watchtower, or does it keep using the same gluetun network once that has been created and not deleted?

I also read this discussion #281 but not sure if it is related.

When I look in portainer at the network settings of a container that is using gluetun, I don't see it is connected to a network, but when I edit the settings, I see network is container and container is gluetun. I suppose this is correct:

[qdm12]

Yes it's exactly due to #281

You could turn of dns over tls and use the dns keep nameserver variable (see the wiki about dns options)

Alternatively you can define fixed Ip addresses for each container in the gluetun docker network, I do this using docker-compose.yml files although it may not be available in Portainer.

[Manfred73]

Looking at the network settings of gluetun, the hostname is: 668a87f12449 and not gluetun.

How can I make sure in the docker-compose file of gluetun that host is set to gluetun? My compose file is as follows:

version: '3.9'

x-volumes: &volumes
  volumes:
    - /share/docker/gluetun:/gluetun

services:
  gluetun:
    container_name: gluetun
    image: qmcgaw/gluetun:v3.28.2
    environment:
      PUID: 0
      PGID: 0
      TZ: Europe/Amsterdam
      VPN_SERVICE_PROVIDER: cyberghost
      OPENVPN_USER: ${OPENVPN_USER}
      OPENVPN_PASSWORD: ${OPENVPN_PASSWORD}
      SERVER_COUNTRIES: Switzerland,Netherlands
    ports:
      - 8888:8888/tcp   # HTTP proxy
      - 8388:8388/tcp   # Shadowsocks
      - 8388:8388/udp   # Shadowsocks
      - 6767:6767       # Bazarr
      - 8112:8112       # Deluge Web UI
      - 6882:6882       # Deluge Incoming Port
      - 58846:58846     # Deluge Daemon Port
      - 58946:58946     # Deluge TCP port for BitTorrent
      - 58946:58946/udp # Deluge UDP port for BitTorrent
      - 5076:5076       # Hydra2
      - 9117:9117       # Jackett
      - 8686:8686       # Lidarr
      - 5055:5055       # Overseerr
      - 9696:9696       # Prowlarr
      - 7878:7878       # Radarr
      - 9292:9292       # Sabnzbd
      - 8989:8989       # Sonarr
      - 81:81           # Spotweb UI
      - 3306:3306       # Spotweb DB
      - 8181:8181       # Tautulli
    restart: always
    cap_add:
      - NET_ADMIN
    <<: *volumes

[qdm12]

It doesn't matter since the DNS over TLS DNS server used (I think it's Cloudflare by default) doesn't know about gluetun. Subscribe to #281 to be alerted when this will be done, but it won't be anytime soon unfortunately (no time, full time job, family etc. 😄)

[Manfred73]

I'm using docker-compose also and only use portainer as graphical interface to check things and stop/start containers every now and then. Would you happen to have an example of a docker-compose file where you set static IP for gluetun?

And if I set static IP, I should use that instead of hostname I assume?

What about the host name of gluetun? This now is 668a87f12449 instead of gluetun. If I use that it works. Is there a way to set hostname of gluetun in glueton compose file?

[Manfred73]

Adding hostname to the gluetun docker-compose file did the trick for me:

..........
services:
  gluetun:
    container_name: gluetun
    image: qmcgaw/gluetun:v3.28.2
    hostname: gluetun
..........

[qdm12]

Awesome thanks for sharing!