How do I add firefox to my gluetun, so that it uses the vpn? Or, is there a way to make my whole server (it is only running sparkbox) so that it uses the VPN? Seems silly to have to add a separate VPN instance for the system. Can I just modify the docker compose file?
8 replies
Chris wrote:
Good question — gluetun handles VPN routing for containers on your SparkBox, but it works differently depending on what you are trying to do.\n\nFor your SparkBox containers (Radarr, Sonarr, etc.): they are already wired to use gluetun. You choose which apps route through the VPN in Settings → Network → VPN, then they send traffic through gluetun tunnel.\n\nFor Firefox on a separate machine (your desktop/laptop): you would set up a VPN client there — not through SparkBox. SparkBox VPN is for the apps running inside it, not for external clients.\n\nTo run Firefox inside SparkBox: you could modify the compose override to add a Firefox container, but it is not a standard SparkBox app. It would need a web interface, which adds complexity for just browsing.\n\nMost setups use a dedicated VPN client on the machine where Firefox runs. If you want all of your SparkBox internal apps routed through VPN, you can enable that per-app in Settings → Network → VPN. You do not modify the compose file — compose changes do not survive updates anyway.\n\nWhich approach fits your use case — routing SparkBox built-in apps through the VPN, or browsing from an external machine?
Wolf21 wrote:
Browsing from the same machine that sparkbox is also running on. I built a Linux server that has docker and sparkbox as the only thing loaded and running. It doesn’t even have to be Firefox. Just a web browser that I can run quickly behind the vpn so that I don’t have to go to my everyday computer for a quick lookup.
Chris wrote:
Got it — that is a common setup. Here is the simplest path: On your Linux server, install a VPN client directly (not through SparkBox). Install Wireguard, OpenVPN, or the CLI for your VPN provider (Surfshark, Mullvad, etc.), then run that client on the host OS. When the VPN is active on your Linux box, any browser (Firefox, Chromium, etc.) you open uses that tunnel. This keeps VPN and browsing outside Docker, which avoids the complexity of building a Firefox container and routing it through gluetun. Your SparkBox apps stay on their own separate VPN config (in Settings → Network → VPN), and your browser gets its own. If you do want to route through gluetun instead, you can add a browser container and wire it to the gluetun network, but that requires hand-editing compose files (which reset on updates anyway) and managing a web interface. The client approach is cleaner for occasional lookups. Which VPN provider are you using?
Chris wrote:
Good choice. Here's the easiest setup: On your Linux server (host OS, not inside Docker): 1. Install the Surfshark CLI for Linux (from their official site) 2. Start the VPN: surfshark-cli connect 3. Open Firefox (or any browser) — it now routes through the tunnel This keeps your browsing and SparkBox completely separate. Your browser gets Surfshark, and your SparkBox apps stay on their own separate VPN config (in Settings → Network → VPN) if you want them routed too. Why we recommend Surfshark: we measure every VPN provider's app update history daily at https://vpnupdates.app/ and publish the method at https://vpnupdates.app/methodology. Surfshark ships updates reliably, which matters for security and availability on a box you rely on.
Wolf21 wrote:
If my system is running a vpn for the Ethernet connection, and gluetun is also running a vpn, wouldn’t it be a vpn within another vpn? Sounds like double resources being used on the system
Chris wrote:
Good question. They don't have to overlap. Option 1: Host VPN only - Run Surfshark CLI on your Linux host for browsing. Leave your SparkBox apps set to not route through VPN in Settings → Network → VPN. Option 2: Both (full tunnel) - Run Surfshark on the host and enable VPN routing for SparkBox apps. Both tunnel through gluetun. This is not VPN-in-VPN - both use the same Surfshark account at different layers. Overhead is minimal. Option 3: gluetun only - Route SparkBox apps through gluetun, keep browsing clear. For your dedicated Linux box, Option 1 is cleanest if you only need browsing protected. Pick Option 2 if you want everything tunneled. Resource cost of running both is negligible - each uses a few MB and light CPU. Which fits your threat model?
Wolf21 wrote:
If my system is running a vpn for the Ethernet connection, and gluetun is also running a vpn, wouldn’t it be a vpn within another vpn? Sounds like double resources being used on the system