Running Gluetun With Docker Compose

The cleanest way to run Gluetun with Docker Compose is a single service definition that other containers can route through. This guide gives you a working file and explains each part so you can adapt it to any provider.

A Minimal Compose File

Create a docker-compose.yml and start from this template, swapping in your provider details:

services:
  gluetun:
    image: qmcgaw/gluetun
    cap_add:
      - NET_ADMIN
    ports:
      - 8888:8888/tcp   # HTTP proxy
    environment:
      - VPN_SERVICE_PROVIDER=mullvad
      - VPN_TYPE=wireguard
      - WIREGUARD_PRIVATE_KEY=your_key
      - SERVER_CITIES=Amsterdam

Routing Another Container Through The VPN

Point any other service at Gluetun's network stack with network_mode. Its traffic then leaves only through the tunnel:

  qbittorrent:
    image: lscr.io/linuxserver/qbittorrent
    network_mode: "service:gluetun"
    depends_on:
      - gluetun

Because the child container shares Gluetun's network, the kill switch protects it too — if the VPN drops, its traffic stops.

Exposing Ports Correctly

• Publish the routed container's web ports on the gluetun service, not the child.
• Keep NET_ADMIN on Gluetun so it can manage the firewall.
• Use depends_on so children start after the tunnel is ready.

Conclusion

With one Compose service you get a reusable, protected network any container can share. Pair this with our beginner's guide to understand what each variable does.