ScriptsApr 17, 2026·3 min read

Gluetun — Lightweight VPN Client Container

Gluetun is a thin Docker container that tunnels all traffic through a VPN provider, letting you route any container's network through a secure VPN connection.

Script Depot
Script Depot · Community
TL;DR
Thin Docker container that routes any container's network traffic through a VPN provider securely.
§01

What it is

Gluetun is a lightweight Docker container that acts as a VPN client, tunneling all network traffic through a supported VPN provider. Instead of configuring VPN clients inside each container, you point other containers at Gluetun's network stack, and all their traffic exits through the VPN tunnel.

This tool is aimed at self-hosters running services like torrent clients, media servers, or privacy-sensitive applications in Docker. Anyone who needs per-container VPN routing without modifying the underlying host network benefits from Gluetun.

§02

How it saves time or tokens

Gluetun eliminates the repetitive work of setting up VPN clients in multiple containers. A single Gluetun instance handles authentication, kill-switch, port forwarding, and DNS leak prevention for every container that shares its network. This consolidation reduces configuration errors and cuts setup time from hours to minutes when managing multiple services behind a VPN.

§03

How to use

  1. Pull the Gluetun Docker image and configure your VPN provider credentials via environment variables
  2. Set network_mode: 'service:gluetun' on any container that should route through the VPN
  3. Start the stack with docker compose up -d and verify the tunnel is active
§04

Example

# docker-compose.yml
services:
  gluetun:
    image: qmcgaw/gluetun
    cap_add:
      - NET_ADMIN
    environment:
      - VPN_SERVICE_PROVIDER=mullvad
      - VPN_TYPE=wireguard
      - WIREGUARD_PRIVATE_KEY=your_key_here
      - SERVER_COUNTRIES=Switzerland
    ports:
      - 8080:8080  # expose app ports here

  myapp:
    image: myapp:latest
    network_mode: 'service:gluetun'
    depends_on:
      - gluetun
§05

Related on TokRepo

§06

Common pitfalls

  • Forgetting cap_add: NET_ADMIN causes the container to fail silently without creating the tunnel
  • Port mappings must go on the Gluetun container, not on the app container using its network
  • Some VPN providers require specific protocol settings; check the Gluetun wiki for your provider's configuration

Frequently Asked Questions

Which VPN providers does Gluetun support?+

Gluetun supports dozens of providers including Mullvad, NordVPN, Surfshark, PIA, ProtonVPN, Windscribe, and many others. It also supports custom OpenVPN and WireGuard configurations for any provider not explicitly listed.

Does Gluetun have a kill switch?+

Yes. Gluetun blocks all outbound traffic if the VPN tunnel drops, preventing any container from leaking its real IP address. This is enabled by default and requires no additional configuration.

Can I run multiple containers through one Gluetun instance?+

Yes. Any container that sets its network_mode to the Gluetun service shares the VPN tunnel. All their traffic exits through the same VPN connection, and you expose their ports on the Gluetun container.

Does Gluetun support WireGuard?+

Yes. Gluetun supports both OpenVPN and WireGuard protocols. WireGuard generally offers better performance and lower overhead. Set VPN_TYPE=wireguard in your environment variables to use it.

How do I check if the VPN tunnel is working?+

Gluetun exposes a health check endpoint and logs the public IP on startup. You can also exec into a connected container and run 'curl ifconfig.me' to verify the exit IP matches your VPN provider's server.

Citations (3)
Related on TokRepo
Self-hosted toolsDevOps toolsFeatured workflows

Discussion

Sign in to join the discussion.
No comments yet. Be the first to share your thoughts.

Related Assets

NAPI-RS — Build Node.js Native Addons in Rust

Write high-performance Node.js native modules in Rust with automatic TypeScript type generation and cross-platform prebuilt binaries.

Script Depot

Mamba — Fast Cross-Platform Package Manager

A drop-in conda replacement written in C++ that resolves environments in seconds instead of minutes.

Script Depot

Plasmo — The Browser Extension Framework

Build, test, and publish browser extensions for Chrome, Firefox, and Edge using React or Vue with hot-reload and automatic manifest generation.

Script Depot
◈Home🔍Search👤Me