Warp-cli in docker

[Rune]

hi there, does anyone know if it’s at all possible to use warp-cli in a docker container? looking to make a few containers location independent and still able to access certain resources only accessible via warp/teams. So far I had no luck installing the client on any standard image I tested in docker.

[albert]

Cloudflare WARP uses the WireGuard VPN protocol. Docker containers need special capabilities to create network interfaces.

I’m not aware of any official support for Cloudflare WARP inside Docker containers, but there are unofficial tools - such as wgcf - that enable you to generate a WireGuard configuration file for Cloudflare WARP.

If you decide to generate a WireGuard config for Cloudflare WARP, you should be able to follow any guide on routing Docker container traffic through a WireGuard interface.

[Rune]

Yeah I came across a few posts using wireguard but for production it’s just a little too … home made. But thx for the input.

[albert]

Once up and running it should be just as stable as warp-cli, but I can understand you’re hesitant about using a hacky solution for production.

I will take a look at creating a proof-of-concept that uses the official warp-cli if I have time later today and then get back to you.

[KianNH]

@albert

I will take a look at creating a proof-of-concept that uses the official warp-cli

FWIW, there’s an undocumented command in warp-cli to enrol using a token but that isn’t a token you can just generate - it’s a token that you yoink from the browser when it attempts to open the WARP app (like an OAuth app does).

It’s not ideal by any means - not sure how long those tokens last but if they’re effectively permanent then it could be an option as opposed to logging in at the time.

Warp-cli: --access-client-id and --access-client-secret no longer exist?

Go to https://teamname.cloudflareaccess.com/warp. Open DevTools. Login. When you get a prompt about opening a link with Cloudflare WARP, press cancel. Look at the request to auth?token=<blah> & copy the Request URL that starts with com.cloudflare.warp Run warp-cli teams-enroll-token "<paste that Request URL here>" Ideal? Probably not - but it works. Source: strings on /usr/bin/warp-cli [image] Maybe the Zero Trust team can chime in with a more seamless flow.

[Rune]

But this enroll function is only in warp-cli? not in wgcf I preume?

[albert]

wgcf let’s you generate a WireGuard config file that can be used with any WireGuard client. This is essentially what the register/teams-enroll command does in warp-cli, with warp-cli also being the WireGuard client.

EDIT: It seems wgcf might not support Teams… I just assumed it did. There’s an existing issue about this: Support Teams/Zero Trust · Issue #56 · ViRb3/wgcf · GitHub

[Rune]

Yeah I found that one too. If CF Warp team could help out it would be great. Just need a warp-cli w/o systemd dependencies etc.

[Rune]

I guess a week of silence speaks for itself.