protonvpn-docker

Docker Images

Images are published on GitHub Container Registry.

Its recommended that you use 64 bit hosts. ARM32 hosts have known issues see here.

Environment Variables

Name	Required	Description
`PROTONVPN_TIER`	Yes	Proton VPN Tier (0=Free, 1=Basic, 2=Pro, 3=Visionary)
`PROTONVPN_USERNAME`	Yes	OpenVPN Username. This is NOT your Proton Account Username.
`PROTONVPN_PASSWORD`	Yes	OpenVPN Password. This is NOT your Proton Account Password.
`PROTONVPN_SERVER`	Yes	ProtonVPN server to connect to. See `PROTONVPN_SERVER` for more info.
`PROTONVPN_PROTOCOL`	No	Protocol to use. By default `udp` is used.
`PROTONVPN_EXCLUDE_CIDRS`	No	Comma separated list of CIDRs to exclude from VPN. Uses split tunnel. Default is set to `169.254.169.254/32,169.254.170.2/32`
`PROTONVPN_DNS_LEAK_PROTECT`	No	(Integer) Setting this to `0` will disable DNS leak protection. If you wish to specify custom DNS server via `--dns` option or running on k8s, you MUST set this to `0`.
`PROTONVPN_CHECK_INTERVAL`	No	(Integer) Interval between internal healthcheck in seconds. Defaults to 90 if not specified or invalid.
`PROTONVPN_IPCHECK_ENDPOINT`	No	Healthcheck endpoint to determine if you are connected via VPN. Defaults to `https://icanhazip.com/`. Must return Your public IP
`PROTONVPN_FAIL_THRESHOLD`	No	(Integer) Number of allowed consecutive internal healthcheck failures before an attempt to reconnect is made. Defaults to 3 if invalid or not specified.

PROTONVPN_SERVER

If set to RANDOM, a random server compatible with your plan will be chosen.
If set to P2P will choose fastest P2P server. Please note that this requires setting correct plan in PROTONVPN_TIER.
If set to ProtonVPN supported country code, will choose the fastest server from this country. (case insensitive). For example to connect to fastest server from Netherlands, set PROTONVPN_SERVER to NL.
If none of the above are true, container will attempt to connect to this server and fail if it is not possible. Please note that Secure Core servers are only available with pro plan and above.

Run Container

# Pull Image
docker pull ghcr.io/tprasadtp/protonvpn:latest
# Run in background
docker run \
--rm \
--detach \
--name=protonvpn \
--device=/dev/net/tun \
--cap-add=NET_ADMIN \
--env PROTONVPN_USERNAME="xxxx" \
--env PROTONVPN_PASSWORD="xxxx" \
--env PROTONVPN_TIER=0 \
--env PROTONVPN_SERVER=NL \
ghcr.io/tprasadtp/protonvpn:latest

Using VPN in other containers

You can use,

docker run \
--name container-with-vpn \
--net=container:protonvpn \
my-awesome-image-name:tag

Docker-Compose

version: '3.4'
services:
  protonvpn:
    container_name: protonvpn
    environment:
      # Credentials
      PROTONVPN_USERNAME: ${PROTONVPN_USERNAME}
      PROTONVPN_PASSWORD: ${PROTONVPN_PASSWORD}
      # Override these where applicable
      PROTONVPN_SERVER: ${PROTONVPN_SERVER:-NL}
      PROTONVPN_TIER: ${PROTONVPN_TIER:-0}
    # Always use semver tags, avoid using tag latest!
    image: ghcr.io/tprasadtp/protonvpn:latest
    restart: unless-stopped
    networks:
      - internet
      - proxy
    cap_add:
      - NET_ADMIN
    devices:
      - /dev/net/tun:/dev/net/tun
    # Expose pyload container's port here!
    expose:
      - 8000
  # Your app using the VPN
  # Here we use pyload as an example
  pyload:
    depends_on:
      - protonvpn
    container_name: pyload
    environment:
      TZ: "Europe/Berlin"
      PGID: "1000"
      PUID: "1000"
    image: linuxserver/pyload:latest
    restart: unless-stopped
    userns_mode: host
    # Do not apply any networking configs
    # on this container!
    # All networking labels and settings should be defined
    # on the vpn container.
    network_mode: service:protonvpn
    volumes:
      - config:/config
      - ./downloads/:/downloads/:rw
volumes:
  config:
networks:
  internet:
  proxy:
    internal: true

It is essential to apply labels and expose port on protonvpn container instead of your application. This is because your application container shares network namespace of protonvpn container.
If using Traefik, apply labels to protonvpn container, and expose your application ports.
You DO NOT need to run the container as privileged. By passing the right tun device and adding NET_ADMIN capabilities should be sufficient.

Changelog

This project follows Semantic Versioning 2.0.0. Changelogs can be found at here.

Troubleshooting

See Troubleshooting.

maclarel/protonvpn-docker

protonvpn-docker

Docker Images

Environment Variables

PROTONVPN_SERVER

Run Container

Using VPN in other containers

Docker-Compose

Changelog

Troubleshooting