I have a container A running a VPN client, then I traffic other containers' (B and C) traffic via container A.

Is there a way to create a container D, which internally is running something like HostAP or RaspAP for the creation a wifi network in e.g. interface wlan0, and then all the traffic is routed via container A?

I found some docker images in docker hub with the above clients for my architechture, and while the few descriptions they have seem to have similar purpose to what I am trying to achieve, none of the worked properly.

If previous option is not possible, how could this be achieved by directly changing the files in the host OS (Raspbian)? The host is connected via eth0 to the router.

First I tried to run the containers directly from the interface eth0 and then tried to attach it to container A. None of them worked.

Docker compose for hostap:

sudo docker run --restart unless-stopped -dit --name hostap \
  -e INTERFACE=docker0 \
  -e CHANNEL=6 \
  -e SSID=runssid \
  -e AP_ADDR= \
  -e SUBNET= \
  -e WPA_PASSPHRASE=passw0rd \
  -e OUTGOINGS=eth0 \
  -e HW_MODE=g \
--net host --privileged sdelrio/rpi-hostap:latest

Log file:

WARNING: The requested image's platform (linux/amd64) does not match the detected host platform (linux/arm/v7) and no specific platform was requested

Then it crashes the entire raspberry docker installation (no access to any other container). I have to kill the container and eliminate to re-gain access.

** Docker compose using raspap:**

sudo docker run --name raspap -it -d --privileged --network=host -v /sys/fs/cgroup:/sys/fs/cgroup:ro --cap-add SYS_ADMIN jrcichra/raspap-docker

This one stops the container after its creation.

Log file:

Detected virtualization docker.
Detected architecture arm.

Welcome to Debian GNU/Linux 10 (buster)!

Set hostname to <Server-Pi>.
Failed to create /init.scope control group: Read-only file system
Failed to allocate manager object: Read-only file system
[!!!!!!] Failed to allocate manager object.


  • Docker running on Raspbian in a Raspberry Pi 4

Docker images checked:

Thanks in advance.

1 Answer 1


The first error you described occurs because the image on docker hub was not build for the cpu architecture of the RPi. The images architecture is linux/amd64, your required architecture is linux/arm/v7. I personally think that it is not very beneficial to run hostap in a container and the base image of rpi-hostap as well as the image itself seems old and unmaintained, but if you really wanted, you could try to build the image yourself.

First, you need to assign an IP to the WLAN interface and create a DNS and DHCP server (like dnsmasq). For that you can find plenty of tutorials online.

As for routing traffic over a VPN container, you need to enable IP forwarding in the container, as well as on the host, create a iptables masquerade rule to the VPN container bridge interface and add a ip rule to route traffic from the WLAN interface using a custom routing table and add a default route to this routing table via the VPN containers IP address. This could like the following:

Enable IP forwarding on the host:
Edit /etc/sysctl.conf, change net.ipv4.ip_forward = 0 to net.ipv4.ip_forward = 1, save and load the changes using sysctl -p.


version: "3.8"

    build: image
    container_name: vpn-01
      - './config/vpn-01/openvpn:/config/openvpn'
    restart: unless-stopped
      - NET_ADMIN
      - net.ipv4.ip_forward=1

    driver: bridge
      name: vpn_net
      driver: default
      - subnet:

Routing and NAT (you could run these on startup after docker.service and hostapd.service):

# MASQUERADE cause wlan1 net has no route in vpn containers and default route changed to vpn
docker_if_vpn="br-$(docker network ls | grep vpn_net | cut -d' ' -f1)"
iptables -t nat -I POSTROUTING -o "${docker_if_vpn}" -j MASQUERADE

# Change default route for traffic from wlan1 to vpn container
docker_ip_vpn="$(docker inspect -f '{{range.NetworkSettings.Networks}}{{.IPAddress}}{{end}}' "${vpn_container_name}")"
ip route add default via "${docker_ip_vpn}" table 202
ip rule add from all iif wlan0 table 202

# Use main routing table first but don't match ("default")
ip rule add from all lookup main suppress_prefixlength 0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .