protonvpn ghcr.io/andrebrait/protonvpn-cli-docker:latest https://github.com/andrebrait/protonvpn-cli-docker/pkgs/container/protonvpn-cli-docker bridge false https://github.com/andrebrait/protonvpn-cli-docker/issues https://github.com/andrebrait/protonvpn-cli-docker https://raw.githubusercontent.com/andrebrait/unraid-templates/main/templates/protonvpn.xml Official Proton VPN CLI with a WebUI and shared VPN network. Proton does not officially support headless use. Open WebUI to sign in (including TOTP) and configure settings, or use the Console button for interactive protonvpn commands. FIDO2 is console-only and unverified. Set a WebUI password: leaving it empty enables open access, even if API_KEY is set. Attach other containers with --network=container:protonvpn and publish their application ports on this VPN container. Set LAN_NETWORKS to your trusted LAN CIDRs for direct application access. Drop NET_RAW from attached containers (--cap-drop=NET_RAW), never grant them NET_ADMIN, and start them only after this container is healthy. The kill switch prevents accidental leaks, not hostile code. If this VPN container is recreated, recreate attached containers to join its new network namespace. The forwarded port is shown in the WebUI and /config/forwarded_port; configure your torrent listener to match it. The supervisor handles reconnects; Docker health status alone does not trigger restarts. Requires cgroup v2, xt_cgroup, WireGuard kernel support and /dev/net/tun. This project is not affiliated with Proton AG. Network:VPN http://[IP]:[PORT:8788]/ https://raw.githubusercontent.com/andrebrait/protonvpn-cli-docker/main/images/icon-256.png --cap-add=NET_ADMIN --device=/dev/net/tun --sysctl net.ipv4.conf.all.src_valid_mark=1 8788 /mnt/user/appdata/protonvpn 8788 UTC 30