Why does X11 break inside Docker container when the container connects to VPN?

Question

My host computer is Windows 10. My objective is to make docker containers that connect to VPNs inside the container. I do this so that I don't have to have my entire host computer on the VPN.

I use ubuntu docker containers that connect, with openconnect, to anyconnect protocol; I have two different containers that connect to two different organizations' VPNs.

Both containers work with X11 to my vcxsrv, e.g. I can see xeyes and even vscode. However, only one will work after I connect it to a VPN.

The container can still connect to websites, ping google, etc. But I have tried setting the DISPLAY variable to the new IPv4 private VPN address, no luck. xeyes does not appear. xeyes runs until I Ctrl+C, but xeyes does not appear on vcxsrv

How can I get X11 to work inside docker container while connected to VPN? My host is NOT connected to VPN. Only the containers have VPNs inside them.

Answer 1

The solution is to use vpn-slice inside the docker container when connecting to VPN:

openconnect -b -v --protocol=anyconnect \
    # some cert files, key files, etc... whatever you normally use
    vpn.myorganization.com \
    -s 'vpn-slice --prevent-idle-timeout mymachine.myorganization.com'

thus only requests and connections destined for mymachine.myorganization.com are put through the VPN. In order to use this, vpn-slice must be installed with pip