container constantly shows running as the status

[ehinkle27]

I just downloaded your and ran your container for PIA but after using the basic docker run, it appears like it is running but when I look at container status it shows as starting. Also if I try to connect to the container via bash it says starting. Here is the logs from the container, not sure what was missed.

storage: creating /gluetun/servers.json with 6739 hardcoded servers
2020-12-30T17:37:36.387Z        INFO    routing: default route found: interface eth0, gateway 172.17.0.1
2020-12-30T17:37:36.388Z        INFO    routing: local subnet found: 172.17.0.0/16
2020-12-30T17:37:36.389Z        INFO    routing: default route found: interface eth0, gateway 172.17.0.1
2020-12-30T17:37:36.390Z        INFO    routing: adding route for 0.0.0.0/0
2020-12-30T17:37:36.390Z        INFO    firewall: firewall disabled, only updating allowed subnets internal list
2020-12-30T17:37:36.390Z        INFO    routing: default route found: interface eth0, gateway 172.17.0.1
2020-12-30T17:37:36.391Z        INFO    openvpn configurator: checking for device /dev/net/tun
2020-12-30T17:37:36.391Z        WARN    TUN device is not available: open /dev/net/tun: no such file or directory
2020-12-30T17:37:36.391Z        INFO    openvpn configurator: creating /dev/net/tun
2020-12-30T17:37:36.391Z        INFO    firewall: enabling...
2020-12-30T17:37:36.583Z        INFO    firewall: enabled successfully
2020-12-30T17:37:36.583Z        INFO    Launching standard output merger
2020-12-30T17:37:36.583Z        INFO    dns over tls: using plaintext DNS at address 1.1.1.1
2020-12-30T17:37:36.583Z        INFO    dns configurator: using DNS address 1.1.1.1 internally
2020-12-30T17:37:36.583Z        INFO    dns configurator: using DNS address 1.1.1.1 system wide
2020-12-30T17:37:36.584Z        INFO    firewall: setting VPN connection through firewall...
2020-12-30T17:37:36.584Z        INFO    http server: listening on 0.0.0.0:8000
2020-12-30T17:37:36.585Z        INFO    healthcheck: listening on 127.0.0.1:9999
2020-12-30T17:37:36.585Z        INFO    openvpn configurator: starting openvpn
2020-12-30T17:37:36.588Z        INFO    openvpn: OpenVPN 2.4.9 x86_64-alpine-linux-musl [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [MH/PKTINFO] [AEAD] built on Apr 20 2020
2020-12-30T17:37:36.589Z        INFO    openvpn: library versions: OpenSSL 1.1.1i  8 Dec 2020, LZO 2.10
2020-12-30T17:37:36.591Z        INFO    openvpn: CRL: loaded 1 CRLs from file [[INLINE]]
2020-12-30T17:37:36.592Z        INFO    openvpn: TCP/UDP: Preserving recently used remote address: [AF_INET]143.244.46.65:1197
2020-12-30T17:37:36.592Z        INFO    openvpn: UDP link local: (not bound)
2020-12-30T17:37:36.592Z        INFO    openvpn: UDP link remote: [AF_INET]143.244.46.65:1197
2020-12-30T17:37:36.970Z        INFO    openvpn: [newjersey405] Peer Connection Initiated with [AF_INET]143.244.46.65:1197
2020-12-30T17:37:38.290Z        INFO    openvpn: OpenVPN ROUTE6: OpenVPN needs a gateway parameter for a --route-ipv6 option and no default was specified by either --route-ipv6-gateway or --ifconfig-ipv6 options
2020-12-30T17:37:38.291Z        INFO    openvpn: OpenVPN ROUTE: failed to parse/resolve route for host/network: 2000::/3
2020-12-30T17:37:38.291Z        INFO    openvpn: TUN/TAP device tun0 opened
2020-12-30T17:37:38.291Z        INFO    openvpn: /sbin/ip link set dev tun0 up mtu 1500
2020-12-30T17:37:38.293Z        INFO    openvpn: /sbin/ip addr add dev tun0 10.5.110.2/24 broadcast 10.5.110.255
2020-12-30T17:37:38.298Z        WARN    openvpn: OpenVPN was configured to add an IPv6 route over tun0. However, no IPv6 has been configured for this interface, therefore the route installation may fail or may not work as expected.
2020-12-30T17:37:38.298Z        INFO    openvpn: UID set to nonrootuser
2020-12-30T17:37:38.298Z        INFO    openvpn: Initialization Sequence Completed
2020-12-30T17:37:38.298Z        INFO    dns configurator: downloading root hints from https://raw.githubusercontent.com/qdm12/files/master/named.root.updated
2020-12-30T17:37:38.785Z        INFO    dns configurator: downloading root key from https://raw.githubusercontent.com/qdm12/files/master/root.key.updated
2020-12-30T17:37:38.871Z        INFO    dns configurator: generating Unbound configuration
2020-12-30T17:37:39.391Z        INFO    dns configurator: 62361 hostnames blocked overall
2020-12-30T17:37:39.391Z        INFO    dns configurator: 2752 IP addresses blocked overall
2020-12-30T17:37:39.433Z        INFO    dns configurator: starting unbound
2020-12-30T17:37:39.433Z        INFO    dns configurator: using DNS address 127.0.0.1 internally
2020-12-30T17:37:39.434Z        INFO    dns configurator: using DNS address 127.0.0.1 system wide
2020-12-30T17:37:39.670Z        INFO    unbound: init module 0: validator
2020-12-30T17:37:39.670Z        INFO    unbound: init module 1: iterator
2020-12-30T17:37:39.719Z        INFO    unbound: start of service (unbound 1.10.1).
2020-12-30T17:37:40.084Z        INFO    unbound: generate keytag query _ta-4a5c-4f66. NULL IN
2020-12-30T17:37:41.493Z        INFO    dns over tls: ready
2020-12-30T17:37:41.494Z        INFO    VPN routing IP address: 143.244.46.65
2020-12-30T17:37:42.207Z        INFO    You are running 2 commits behind the most recent latest
2020-12-30T17:37:43.734Z        INFO    ip getter: Public IP address is 143.244.46.65

[qdm12]

Hey there! This is actually expected. This 'weirdness' has been there for months; funnily enough I tried to solve it this morning (see #283) but it's actually not possible because of the way the built-in Docker healthcheck works. It only triggers after 10 minutes and therefore it will show as starting for the firsr 10 minutes before turning to 'Healthy'. You can also disable the healthcheck if this bothers you. See answer below

[qdm12]

Actually, overthinking it, I'll re-open #283 and address it. I'll make it run on smaller intervals and have the DNS resolution run periodically instead of being triggered by the healthcheck. A bit convoluted to explain, but it should work 😄

[qdm12]

The healthcheck thing is fixed in 11338b6 😉

Now for your config issue, are you publishing the port on gluetun (-p 8080:8080/tcp)? Exposing is not enough (unless you use a reverse proxy etc.). Maybe share you run config (and remove creds)?

[ehinkle27]

this is my config:

  gluetun-vpn:
#    image: itsdaspecialk/pia-openvpn:latest
    image: qmcgaw/gluetun
    container_name: gluetun
    restart: always
    cap_add:
      - net_admin
    dns:
      - 209.222.18.222
      - 209.222.18.218
    ports:
      - 9091:9091/tcp
      - 8080:8080/tcp
      - 8000:8000/tcp
      - 8388:8388/tcp
      - 8888:8888/tcp
      - 8388:8388/udp
    networks:
      - t2_proxy
    volumes:
      - $DOCKERDIR/gluetun:/gluetun
    environment:
      USER_ID: $PUID
      GROUP_ID: $PGID
      UMASK: 002
      TZ: $TZ
      REGION: "US EAST"
      VPNSP: "private internet access"
      OPENVPN_USER: "username"
      OPENVPN_PASSWORD: "XXXX"
      DOT: "off"
      DNS_PLAINTEXT_ADDRESS: "1.1.1.1"
#      FIREWALL_OUTBOUND_SUBNETS: "192.168.90.0/24"
      FIREWALL_INPUT_PORTS: "8000,8080,8888,8388"

[ehinkle27]

This is my second container config that I tried to access the mapped port on.

## Sabnzbd
  sabnzbd:
    image: linuxserver/sabnzbd:latest
    container_name: sabnzbd
    restart: unless-stopped
#    networks:
#      - t2_proxy
    network_mode: "service:gluetun-vpn"
    depends_on:
      - gluetun-vpn
    security_opt:
      - no-new-privileges:true
#    ports:
#      - "$SABNZBD_PORT:8080"
#      - "8081:8080"
    volumes:
      - $DOCKERDIR/sabnzbd:/config
      - $DOCKERDIR/Downloads:/downloads
    #   - $USERDIR/Downloads/incomplete:/incomplete-downloads
    environment:
      PUID: $PUID
      PGID: $PGID
      TZ: $TZ
      UMASK_SET: 002

[ehinkle27]

Not sure why it removes my comment markers but the port section is commented out in my config.

[qdm12]

Not sure why it removes my comment markers but the port section is commented out in my config.

You need to surround your code with a starting line ```yml and an end line ````

This is my second container config that I tried to access the mapped port on.

• Is it in the same docker-compose.yml? If not you need to use network_mode: "container:gluetun-vpn".
• You can remove the depends_on: block it shouldn't be necessary
• Otherwise your port publishing looks fine, you should be able to access it on port 8080 on your host

this is my config:

• You don't need to specify FIREWALL_INPUT_PORTS this is only for VPN side port forwarding, and it introduces some security holes too
• Your config looks fine 🤔

[qdm12]

Slow healtcheck is now fast in :latest and will be included in the v3.10.0 image once it's released (associated commit: 11338b6)