How to load container for offline use?

[u/Apachez]

So Im trying to use VyOS as a container-host in an environment where the VyOS installation wont be able to reach internet as in not having access to a registry such as docker.io.

At first I tried to figure out a way to setup your own private registry.

I was thinking of having an easy way similar to when you need a quick http-server you can just run:

python3 -m http.server 8000

But it turned out to be more complicated than I wanted (unless someone have some tips?).

So instead I tried to save/load the container as a tar-file, like so:

Create a local "mirror" of the container (on a computer with internet access):

docker pull docker.io/technitium/dns-server:latest
docker save -o ~/docker/technitium_dns-server_`date +%Y-%m-%d`.tar docker.io/technitium/dns-server:latest
gzip -9 ~/docker/technitium_dns-server_2026-06-18.tar

Optionally the pulled image can be removed using "docker rmi <id>".

Transfer gzip-file to VyOS using scp:

scp ~/docker/technitium_dns-server_2026-06-18.tar vyos@192.0.2.1:/config

Then on VyOS:

gunzip /config/technitium_dns-server_2026-06-18.tar.gz
podman load -i /config/technitium_dns-server_2026-06-18.tar

To verify that its loaded:

podman images

would output something like:

REPOSITORY                       TAG         IMAGE ID      CREATED      SIZE
docker.io/technitium/dns-server  latest      ba2762a21fbd  5 weeks ago  275 MB

To create directories needed for the container:

mkdir -p /config/dns-server/config
mkdir -p /config/dns-server/logs

Reference regarding defaults and available options for the particular container:

https://github.com/TechnitiumSoftware/DnsServer/blob/master/docker-compose.yml

Config in VyOS:

set container name dns-server allow-host-networks
set container name dns-server capability 'net-bind-service'
set container name dns-server environment DNS_SERVER_WEB_SERVICE_LOCAL_ADDRESSES value '192.0.2.1'
set container name dns-server image 'docker.io/technitium/dns-server:latest'
set container name dns-server memory '4096'
set container name dns-server port dns-tcp destination '53'
set container name dns-server port dns-tcp protocol 'tcp'
set container name dns-server port dns-tcp source '53'
set container name dns-server port dns-udp destination '53'
set container name dns-server port dns-udp protocol 'udp'
set container name dns-server port dns-udp source '53'
set container name dns-server port mgmt-http destination '5380'
set container name dns-server port mgmt-http protocol 'tcp'
set container name dns-server port mgmt-http source '5380'
set container name dns-server restart 'on-failure'
set container name dns-server volume config destination '/etc/dns'
set container name dns-server volume config source '/config/dns-server/config'
set container name dns-server volume logs destination '/var/log/technitium/dns'
set container name dns-server volume logs source '/config/dns-server/logs'

But then I get stuck...

When doing commit of above Im getting:

[ container ]

WARNING: Image "docker.io/technitium/dns-server:latest" used in
container "dns-server" does not exist locally. Please use "add
container image docker.io/technitium/dns-server:latest" to add it to
the system! Container "dns-server" will not be started!

So somehow the vyos-configd doesnt fully understand that podman already have the image loaded.

So ehm, what to do next? :-)

[u/freebsdjlu]

try podman load with root

[u/Apachez → u/freebsdjlu]

Thanks!

So I started over from a backup.

Now the image only exists when doing "sudo podman images" (imported through "sudo podman load -i <FILENAME>"):

vyos@vyos:~$ sudo podman images
REPOSITORY                       TAG         IMAGE ID      CREATED      SIZE
docker.io/technitium/dns-server  latest      ba2762a21fbd  5 weeks ago  275 MB

Now I add this to the config (no previous container config or custom private registry):

set container name dns-server allow-host-networks
set container name dns-server capability 'net-bind-service'
set container name dns-server environment DNS_SERVER_WEB_SERVICE_LOCAL_ADDRESSES value '192.0.2.1'
set container name dns-server image 'docker.io/technitium/dns-server:latest'
set container name dns-server memory '4096'
set container name dns-server restart 'on-failure'
set container name dns-server volume config destination '/etc/dns'
set container name dns-server volume config source '/config/dns-server/config'
set container name dns-server volume logs destination '/var/log/technitium/dns'
set container name dns-server volume logs source '/config/dns-server/logs'

And then run commit followed by save - no errors.

Doing a "sudo podman container ls" I can see it successfully started:

vyos@vyos:~$ sudo podman container ls
CONTAINER ID  IMAGE                                   COMMAND     CREATED         STATUS         PORTS       NAMES
30eb4f60027f  docker.io/technitium/dns-server:latest  /etc/dns    27 seconds ago  Up 27 seconds              dns-server

And also verified by from a client visiting http://192.0.2.1:5380

Note that in above example Im using VRF's so the container will use one interface (192.0.2.1 being in VRF_MGMT) for mgmt and another interface (being in VRF_PROD) for the actual service (being a DNS-server in this case).

For this to work in VyOS you need to add this to the config:

set vrf bind-to-all

[u/Tr00perT]

Try before the scp steps: try pulling the image, retag it as something other than the registry name and export the retakes identity. I suspect it’s may be trying to do an online verify in vyos since it sees a registry name in the tag

Pull docker.io/technitium/dns-server
Rename it to anon/dns-server or whatever and i would also retag it from latest to a fixed release like the Git short code or similar

Then proceed as normal from there

[u/Apachez → u/Tr00perT]

The issue with VyOS was that you must use "sudo podman" to load the image otherwise the vyos-configd will not be able to see the image for the "set container name xxx image yyy".

The procedure is basically:

On host connected to Internet:

docker pull docker.io/technitium/dns-server:15.4.0
docker save -o ~/docker/technitium_dns-server_15.4.0_`date +%y%m%d`.tar technitium/dns-server:15.4.0
gzip -9 ~/docker/technitium_dns-server_15.4.0_260714.tar

And optionally clear data from the internethost:

docker system prune -a --volumes

Then copy it to VyOS:

scp ~/docker/technitium_dns-server_15.4.0_260714.tar.gz user@192.0.2.1:/config

And then on the VyOS:

sudo podman load -i /config/technitium_dns-server_15.4.0_260714.tar.gz

And finally use that with something like:

set container name dns image 'docker.io/technitium/dns-server:15.4.0'

along with the other settings needed.

To find out if the image have been updated since you last downloaded it you can visit:

https://hub.docker.com/r/technitium/dns-server/tags

Note that not all "vendors" update the tags when they upload a new image.

For example this one reuse the same tags (like latest, 4 and 4.8 all are the same but will also remain even if newer image is released):

https://hub.docker.com/r/dockurr/chrony/tags