sando38/docker-eturnal

The image is now maintained in the official > https://github.com/processone/eturnal/pkgs/container/eturnal <

This repository is archieved.

Latest trivy image scan result from the latest image sando38/docker-eturnal:v1.8.3-4 hosted on DockerHub:

root@arm64:/home# trivy image sando38/docker-eturnal:v1.8.3-4
2022-05-30T19:34:02.179+0100    INFO    Need to update DB
2022-05-30T19:34:02.179+0100    INFO    DB Repository: ghcr.io/aquasecurity/trivy-db
2022-05-30T19:34:02.179+0100    INFO    Downloading DB...
32.11 MiB / 32.11 MiB [------------------------------------------] 100.00% 3.80 MiB p/s 8.6s
2022-05-30T19:34:16.396+0100    INFO    Detected OS: alpine
2022-05-30T19:34:16.397+0100    INFO    This OS version is not on the EOL list: alpine 3.16
2022-05-30T19:34:16.398+0100    INFO    Detecting Alpine vulnerabilities...
2022-05-30T19:34:16.401+0100    INFO    Number of language-specific files: 0

sando38/docker-eturnal:v1.8.3-4 (alpine 3.16.0)

Total: 0 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 0, CRITICAL: 0)

Docker image for eturnal STUN/TURN server

This is a multi-arch eturnal docker image, currently built for

• linux/amd64,
• linux/386,
• linux/s390x,
• linux/ppc64le,
• linux/arm64,
• linux/arm/v7,
• linux/arm/v6

and based on Alpine Linux.

Usage

To pull the image, just refer to the Docker Hub repository:

docker pull sando38/docker-eturnal

The image will run in eturnal foreground mode, if started this way:

docker run -d sando38/docker-eturnal:latest

The image can also run in a less "privileged" mode:

docker run -d \
  --name eturnal \
  --user 9000:9000 \
  -v /path/to/eturnal.yml:/opt/eturnal/etc/eturnal.yml \
  -p 3478:3478/udp \
  -p 49152-65535:49152-65535/udp \
  --read-only \
  --security-opt no-new-privileges \
  --cap-drop=ALL \
  sando38/docker-eturnal:latest

As an alternative since https://github.com/instrumentisto/coturn-docker-image/issues/3 with using the host network --network=host. Please note, that the docker container is not isolated from the host network anymore when using this option.

docker run -d \
  --name eturnal \
  --user 9000:9000 \
  -v /path/to/eturnal.yml:/opt/eturnal/etc/eturnal.yml \
  --network=host \
  --read-only \
  --security-opt no-new-privileges \
  --cap-drop=ALL \
  sando38/docker-eturnal:latest

NOTE: When running --network=host or similarly with network_mode: "host" in compose or hostNetwork: true in kubernetes, *** to set ERL_EPMD_ADDRESS=127.0.0.1 to not publish the EPMD daemon (default port 4369) to the outside world.

Inspect the running container with

docker logs < container name >

Note: for logs to be printed with docker logs command, log_dir: in eturnal.yml should be set to stdout.

To use the eturnalctl command, e.g. just run:

docker exec < container name > eturnalctl info

Tags

vXX.YY.ZZ represents the official eturnal release. -AA suffix for image version of the particular release in case of any bug fix, etc. of the image.

Configuration

Configuration is mainly done by the mounted eturnal.yml file (recommended). Here is an example https://github.com/processone/eturnal/blob/master/config/eturnal.yml file. However, eturnal may also be configured with some environment variables (see eturnal documentation).

The configuration file is best mounted directly into the container:

Mountpath: -v /path/to/eturnal.yml:/opt/eturnal/etc/eturnal.yml

Here are some more hints how to configure eturnal.

Volume mounts

Volumes may be mounted for the configuration file and tls certificates/ dh-parameter file. TLS certificates and dh-parameter file shall be .pem files.

volumes:
  - /path/to/eturnal.yml:/opt/eturnal/etc/eturnal.yml  # for (custom) configuration file
  - /path/to/cert-files:/opt/eturnal/tls               # for tls certicates

TLS certificates must be readable by eturnal user/ group 9000:9000 and should not have world readable access rights (chmod 400).

Readonly file system & .erlang.cookie file (only relevant for tag v1.8.3)

If you want to use a readonly file system (--read-only, in compose read_only: true or in kubernetes' securityContext, readOnlyRootFilesystem: true), the .erlang.cookie file must be mounted with the correct permissions (owned (chown 9000:9000) and readonly (chmod 400) by eturnal user) into the container.

Here is a quick checklist:

• Create cookie with correct read-only permissions (chmod 0400) and owner 9000:9000
  • echo "My1-ErlanG2-CookiE3" > /path/to/COOKIE
• Mount cookie to: -v /path/to/COOKIE:/opt/eturnal/.erlang.cookie

For kubernetes an initContainers may be used to achieve the correct file permissions.