Set up a tunnel with Docker

You need the role Administrator or Operator.

Compose file

docker-compose.tunnel.yml

services:
  paron-tunnel-init:
    image: ghcr.io/nicolabovolato/paron:latest
    command: ["tunnel", "bootstrap"]
    volumes:
      - paron-tunnel-data:/data
    environment:
      PARON_TUNNEL_TOKEN: paron://paron.example.com:443/00000000-0000-7000-8000-000000000000?fingerprint=sha256:0000000000000000000000000000000000000000000000000000000000000000&secret=0000000000000000

  paron-tunnel:
    image: ghcr.io/nicolabovolato/paron:latest
    command: ["tunnel", "run"]
    restart: unless-stopped
    stop_grace_period: 20s
    depends_on:
      paron-tunnel-init:
        condition: service_completed_successfully
    network_mode: host
    read_only: true
    cap_drop:
      - ALL
    security_opt:
      - no-new-privileges:true
    tmpfs:
      - /tmp
    volumes:
      - paron-tunnel-data:/data
    environment:
      PARON_TUNNEL_PORTS: "22,5432"
      # PARON_TUNNEL_ALL_PORTS: "true"
      # PARON_TUNNEL_SOCKETS: /run/postgresql/.s.PGSQL.5432
      # PARON_TUNNEL_ALL_SOCKETS: "true"

volumes:
  paron-tunnel-data:

Start the tunnel

1. In the web UI, add the machine with the connection Tunneled.

2. In the menu of the machine, select Set up tunnel, and copy the token. Paron shows the token only once. The token is valid for 15 minutes and for one use.

3. On the machine, save the file above as docker-compose.tunnel.yml.

4. In the service paron-tunnel-init, set PARON_TUNNEL_TOKEN to the token. In the service paron-tunnel, set PARON_TUNNEL_PORTS to the ports that the server can reach. Include the SSH port of the machine.

5. Start the services.

   docker compose -f docker-compose.tunnel.yml up -d

The file has two services. paron-tunnel-init runs paron tunnel bootstrap one time and registers the machine. paron-tunnel runs paron tunnel run.

Sockets

The container does not see the sockets of the host. To allow a socket, mount it into the service paron-tunnel. The container runs as the user 65532, so this user must have permission to use the socket.

Host network

The tunnel connects only to the loopback address of the machine. For this reason the container uses the network of the host (network_mode: host).