Simple example using an interactive shell.

ZeroTier One makes ZeroTier virtual networks available as 'tap' virtual network ports. To do this inside a Docker container requires a few elevated permissions and access to the /dev/net/tun device.

Fortunately this is easy:

Where [... command ...] is an optional command, in the example below we'll provide /bin/bash to get an interactive shell.

SYS_ADMIN is needed because NET_ADMIN does not include the ioctl() required to put /dev/net/tun in tap mode. This appears to be a bug in Linux's capability model but it would have to be fixed upstream.

Here's a transcript of an example session where we start a command prompt in a test container, install ZeroTier, start it (must be done manually here because the container does not run init or systemd), join a test network, and ping something.

Starting a container with an interactive shell:

Then, while inside the container we install ZeroTier:

Start ZeroTier and join a network:

Try pinging something:

Exit