title: Connect to VPN with Podman
body: <p>Having this <code>Dockerfile</code>:</p>
  
  <pre><code>FROM fedora:30
  
  ENV LANG C.UTF-8
  
  RUN dnf upgrade -y \
      &amp;&amp; dnf install -y \
          openssh-clients \
          openvpn \
          slirp4netns \
      &amp;&amp; dnf clean all
  
  CMD ["openvpn", "--config", "/vpn/ovpn.config", "--auth-user-pass", "/vpn/ovpn.auth"]
  </code></pre>
  
  <p>Building the image with:</p>
  
  <pre><code>podman build -t peque/vpn .
  </code></pre>
  
  <p>If I try to run it with (note <code>$(pwd)</code>, where the VPN configuration and credentials are stored):</p>
  
  <pre><code>podman run -v $(pwd):/vpn:Z --cap-add=NET_ADMIN --device=/dev/net/tun -it peque/vpn
  </code></pre>
  
  <p>I get the following error:</p>
  
  <pre><code>ERROR: Cannot open TUN/TAP dev /dev/net/tun: Permission denied (errno=13)
  </code></pre>
  
  <p>Any ideas on how could I fix this? I would not mind changing the base image if that could help (i.e.: to Alpine or anything else as long as it allows me to use <code>openvpn</code> for the connection).</p>
  
  <h2>System information</h2>
  
  <p>Using Podman <code>1.4.4</code> (rootless) and Fedora 30 distribution with kernel <code>5.1.19</code>.</p>
  
  <h2><code>/dev/net/tun</code> permissions</h2>
  
  <p>Running the container with:</p>
  
  <pre><code>podman run -v $(pwd):/vpn:Z --cap-add=NET_ADMIN --device=/dev/net/tun -it peque/vpn
  </code></pre>
  
  <p>Then, from the container, I can:</p>
  
  <pre><code># ls -l /dev/ | grep net
  drwxr-xr-x. 2 root   root       60 Jul 23 07:31 net
  </code></pre>
  
  <p>I can also list <code>/dev/net</code>, but will get a "permission denied error":</p>
  
  <pre><code># ls -l /dev/net
  ls: cannot access '/dev/net/tun': Permission denied
  total 0
  -????????? ? ? ? ?            ? tun
  </code></pre>
  
  <h2>Trying <code>--privileged</code></h2>
  
  <p>If I try with <code>--privileged</code>:</p>
  
  <pre><code>podman run -v $(pwd):/vpn:Z --privileged --cap-add=NET_ADMIN --device=/dev/net/tun -it peque/vpn
  </code></pre>
  
  <p>Then instead of the permission-denied error (errno=13), I get a no-such-file-or-directory error (errno=2):</p>
  
  <pre><code>ERROR: Cannot open TUN/TAP dev /dev/net/tun: No such file or directory (errno=2)
  </code></pre>
  
  <p>I can effectively verify there is no <code>/dev/net/</code> directory when using <code>--privileged</code>, even if I pass the <code>--cap-add=NET_ADMIN --device=/dev/net/tun</code> parameters.</p>
  
  <h2>Verbose log</h2>
  
  <p>This is the log I get when configuring the client with <code>verb 3</code>:</p>
  
  <pre><code>OpenVPN 2.4.7 x86_64-redhat-linux-gnu [SSL (OpenSSL)] [LZO] [LZ4] [EPOLL] [PKCS11] [MH/PKTINFO] [AEAD] built on Feb 20 2019
  library versions: OpenSSL 1.1.1c FIPS  28 May 2019, LZO 2.08
  Outgoing Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
  Incoming Control Channel Authentication: Using 160 bit message hash 'SHA1' for HMAC authentication
  TCP/UDP: Preserving recently used remote address: [AF_INET]xx.xx.xx.xx:1194
  Socket Buffers: R=[212992-&gt;212992] S=[212992-&gt;212992]
  UDP link local (bound): [AF_INET][undef]:0
  UDP link remote: [AF_INET]xx.xx.xx.xx:1194
  TLS: Initial packet from [AF_INET]xx.xx.xx.xx:1194, sid=3ebc16fc 8cb6d6b1
  WARNING: this configuration may cache passwords in memory -- use the auth-nocache option to prevent this
  VERIFY OK: depth=1, C=ES, ST=XXX, L=XXX, O=XXXXX, emailAddress=email@domain.com, CN=internal-ca
  VERIFY KU OK
  Validating certificate extended key usage
  ++ Certificate has EKU (str) TLS Web Server Authentication, expects TLS Web Server Authentication
  VERIFY EKU OK
  VERIFY OK: depth=0, C=ES, ST=XXX, L=XXX, O=XXXXX, emailAddress=email@domain.com, CN=ovpn.server.address
  Control Channel: TLSv1.2, cipher TLSv1.2 ECDHE-RSA-AES256-GCM-SHA384, 2048 bit RSA
  [ovpn.server.address] Peer Connection Initiated with [AF_INET]xx.xx.xx.xx:1194
  SENT CONTROL [ovpn.server.address]: 'PUSH_REQUEST' (status=1)
  PUSH: Received control message: 'PUSH_REPLY,route xx.xx.xx.xx 255.255.255.0,route xx.xx.xx.0 255.255.255.0,dhcp-option DOMAIN server.net,dhcp-option DNS xx.xx.xx.254,dhcp-option DNS xx.xx.xx.1,dhcp-option DNS xx.xx.xx.1,route-gateway xx.xx.xx.1,topology subnet,ping 10,ping-restart 60,ifconfig xx.xx.xx.24 255.255.255.0,peer-id 1'
  OPTIONS IMPORT: timers and/or timeouts modified
  OPTIONS IMPORT: --ifconfig/up options modified
  OPTIONS IMPORT: route options modified
  OPTIONS IMPORT: route-related options modified
  OPTIONS IMPORT: --ip-win32 and/or --dhcp-option options modified
  OPTIONS IMPORT: peer-id set
  OPTIONS IMPORT: adjusting link_mtu to 1624
  Outgoing Data Channel: Cipher 'AES-128-CBC' initialized with 128 bit key
  Outgoing Data Channel: Using 160 bit message hash 'SHA1' for HMAC authentication
  Incoming Data Channel: Cipher 'AES-128-CBC' initialized with 128 bit key
  Incoming Data Channel: Using 160 bit message hash 'SHA1' for HMAC authentication
  ROUTE_GATEWAY xx.xx.xx.xx/255.255.255.0 IFACE=tap0 HWADDR=0a:38:ba:e6:4b:5f
  ERROR: Cannot open TUN/TAP dev /dev/net/tun: No such file or directory (errno=2)
  Exiting due to fatal error
  </code></pre>
  
  <p>Error number may change depending on whether I run the command with <code>--privileged</code> or not.</p>