Openconnect-SSO in Docker - Revision history

John3-16: 1. Added 'See also' section: 'Docker image example on hub.docker.com', 'An openconnect-sso Docker implementation for X11', 'openconnect-sso GitHub repository'; 2. Added categories: Networking, VPN, Virtualization‏‎, Authentication.

2026-02-26T00:54:08Z

1. Added 'See also' section: 'Docker image example on hub.docker.com', 'An openconnect-sso Docker implementation for X11', 'openconnect-sso GitHub repository'; 2. Added categories: Networking, VPN, Virtualization‏‎, Authentication.

← Older revision		Revision as of 00:54, 26 February 2026
Line 128:		Line 128:
	== Why use Docker? ==		== Why use Docker? ==
	System updates broke the bare metal openconnect-sso install. Docker keeps things static. Another way would be pyenv - please add steps below if you succeed with it.		System updates broke the bare metal openconnect-sso install. Docker keeps things static. Another way would be pyenv - please add steps below if you succeed with it.

			== See also ==
			* [https://hub.docker.com/r/morgan404/openconnect-client Docker image example on hub.docker.com] - Uses an Alpine Linux-based container using OpenConnect and OpenSSH Docker. Also enables automatic server certificate handling, which simplifies configuration.
			* [https://github.com/tuapuikia/openconnect-sso-docker An openconnect-sso Docker implementation for X11] - Includes host networking.
			* [https://github.com/vlaci/openconnect-sso openconnect-sso GitHub repository] - Installation, authentication logic, usage (without Docker), authentication logic and for updates upstream.

			[[Category:Networking]]
			[[Category:VPN]]
			[[Category:Virtualization‏‎]]
			[[Category:Authentication]]

Benaki at 13:40, 25 February 2026

2026-02-25T13:40:01Z

← Older revision		Revision as of 13:40, 25 February 2026
Line 1:		Line 1:
	= VPN via openconnect-sso (Docker) =		= VPN via openconnect-sso (Docker) =

	This guide describes how to connect to a Cisco AnyConnect-compatible VPN using openconnect-sso running inside a Docker container, with automatic DNS configuration on connect. ~~Here~~ the WM / compositor of the client is Wayland ~~(I run sway or niri)~~.		This guide describes how to connect to a Cisco AnyConnect-compatible VPN using openconnect-sso running inside a Docker container, with automatic DNS configuration on connect. It is assumed the WM / compositor of the client is Wayland.

	== Prerequisites ==		== Prerequisites ==

Benaki: /* Building the Docker image */

2026-02-25T13:39:11Z

Building the Docker image

← Older revision		Revision as of 13:39, 25 February 2026
Line 64:		Line 64:
	<pre>		<pre>
	docker build -f Dockerfile.openconnect-sso -t openconnect-sso .		docker build -f Dockerfile.openconnect-sso -t openconnect-sso .
	docker create --name openconnect-sso \		doas docker create -it \
	--~~cap~~-~~add NET_ADMIN~~ \		--name openconnect-sso \
			--privileged \
			--net=host \
			-v /etc/ssl/certs:/etc/ssl/certs:ro \
			-e WAYLAND_DISPLAY=$WAYLAND_DISPLAY \
			-e XDG_RUNTIME_DIR=/tmp \
			-e QT_QPA_PLATFORM=wayland \
			-v $XDG_RUNTIME_DIR/$WAYLAND_DISPLAY:/tmp/$WAYLAND_DISPLAY:rw \
	--device /dev/net/tun \		--device /dev/net/tun \
	openconnect-sso \		openconnect-sso:latest \
	--server your-vpn-gateway \		--server your-vpn-gateway \
	--user your-username		--user your-username

Benaki at 13:10, 25 February 2026

2026-02-25T13:10:21Z

← Older revision		Revision as of 13:10, 25 February 2026
Line 63:		Line 63:

	<pre>		<pre>
	~~cd ~/vpn~~
	docker build -f Dockerfile.openconnect-sso -t openconnect-sso .		docker build -f Dockerfile.openconnect-sso -t openconnect-sso .
	docker create --name openconnect-sso \		docker create --name openconnect-sso \

Benaki at 10:20, 25 February 2026

2026-02-25T10:20:33Z

← Older revision		Revision as of 10:20, 25 February 2026
Line 1:		Line 1:
	= VPN via openconnect-sso (Docker) =		= VPN via openconnect-sso (Docker) =

	This guide describes how to connect to a Cisco AnyConnect-compatible VPN using openconnect-sso running inside a Docker container, with automatic DNS configuration on connect.		This guide describes how to connect to a Cisco AnyConnect-compatible VPN using openconnect-sso running inside a Docker container, with automatic DNS configuration on connect. Here the WM / compositor of the client is Wayland (I run sway or niri).

	== Prerequisites ==		== Prerequisites ==

Benaki at 10:14, 25 February 2026

2026-02-25T10:14:18Z

← Older revision		Revision as of 10:14, 25 February 2026
Line 119:		Line 119:

	You may also want to restore your original <code>/etc/resolv.conf</code> afterwards if it is not managed by another service.		You may also want to restore your original <code>/etc/resolv.conf</code> afterwards if it is not managed by another service.

			== Why use Docker? ==
			System updates broke the bare metal openconnect-sso install. Docker keeps things static. Another way would be pyenv - please add steps below if you succeed with it.

Benaki at 10:10, 25 February 2026

2026-02-25T10:10:11Z

← Older revision		Revision as of 10:10, 25 February 2026
Line 9:		Line 9:
	* The <code>openconnect-sso</code> Docker image built (see below)		* The <code>openconnect-sso</code> Docker image built (see below)
	* A VPN-specific <code>resolv.conf</code> saved at <code>~/.local/resolv.conf</code>		* A VPN-specific <code>resolv.conf</code> saved at <code>~/.local/resolv.conf</code>

			If you don't know the DNS for <code>resolv.conf</code>, you can remove that part and connect via IP(s) directly, not DNS.

	== Building the Docker image ==		== Building the Docker image ==

Benaki at 10:07, 25 February 2026

2026-02-25T10:07:16Z

← Older revision		Revision as of 10:07, 25 February 2026
Line 117:		Line 117:

	You may also want to restore your original <code>/etc/resolv.conf</code> afterwards if it is not managed by another service.		You may also want to restore your original <code>/etc/resolv.conf</code> afterwards if it is not managed by another service.

	~~== See also ==~~

	* [[Docker]]

Benaki at 10:06, 25 February 2026

2026-02-25T10:06:41Z

← Older revision		Revision as of 10:06, 25 February 2026
Line 77:		Line 77:
	== Connecting ==		== Connecting ==

	Save the following script (e.g. <code>~/vpn/connect.sh</code>) and make it executable:		Save the following script (e.g. <code>~/.local/bin/vpn-connect.sh</code>) and make it executable:

	<pre>		<pre>
Line 93:		Line 93:

	<pre>		<pre>
	chmod +x ~/vpn/connect.sh		chmod +x ~/.local/bin/vpn-connect.sh
	</pre>		</pre>

Line 99:		Line 99:

	<pre>		<pre>
	~/vpn/connect.sh		~/.local/bin/vpn-connect.sh
	</pre>		</pre>

Benaki at 10:05, 25 February 2026

2026-02-25T10:05:06Z

← Older revision		Revision as of 10:05, 25 February 2026
Line 6:		Line 6:

	* [[Docker]] installed and running		* [[Docker]] installed and running
	* [[doas]] configured		* doas configured
	* The <code>openconnect-sso</code> Docker image built (see below)		* The <code>openconnect-sso</code> Docker image built (see below)
	* A VPN-specific <code>resolv.conf</code> saved at <code>~/.local/resolv.conf</code>		* A VPN-specific <code>resolv.conf</code> saved at <code>~/.local/resolv.conf</code>