Unable to connect to IPsec VPN after running Dev Container
Hello,
i am using latest Manjaro Linux with Gnome Desktop and PhpStorm. I have also configured some Dev Container and they working also fine (running the IDE in Remote Mode).
When i work from home i need also VPN. The connection is configured in NetworkManager and its usually working fine.
But running a Dev Containers will break my already established VPN connection and i am not able to reconnect anymore, even not after stopping the IDE/Dev Container! The connection to VPN Server timed out (UDP port 500).
I have to restart my whole PC to reconnect VPN successfully. I am actually have absolutely no idea what's wrong here, so i have checked the the network setting before and after running the Dev Container.
What i have checked so far:
- restart docker.service and NetworkManager.service → don't help, can't still reconnect
- Kill Gnome and start a new Gnome Shell or Logoff/Login User → don't help, can't still reconnect
- routing table ("ip route show") is the same like before, no changes
- Ethernet adapters and bridges ("ip a") are the same like before, no changes
- package filter ("iptables -L") are the same like before, no changes
Could anybody help me to find the problem?
Please sign in to leave a comment.
Update:
The VPN connection will be lost because the pppd (Point-to-Point Protocol daemon) are stopped and the tunnel device are removed. I don't know why! The ppp0 device is not part of any bridge. Maybe it is a docker or kernel problem.
Workaround: Disconnect VPN, start Dev Container, connect VPN again.
PS: the reason why i cant reconnect immediately is a security setting on our VPN Server.
Update: It might sound a bit strange, but when I start the Dev Container using VS Code, the VPN connection stays active!
Hi Paul,
Which PhpStorm version are you running?
With the VPN connected and the IDE closed, could you try running the following command in the terminal?
Please tell me whether your VPN is still connected after that.
Also, could you confirm:
devcontainer.jsonusedockerComposeFile, or a plainimageordockerFile?Hello Petar Milunovic
I am using devcontainer.json with dockerComposeFile and latest PhpStorm (2026.2.1). The dev container is allway working well.
"docker run" don't interrupt anything. I've testet this 1000 times. Even with the same docker-compose.yml file referenced by dockerComposeFile in my devcontainer.json.
I guess it's the heavy system load during start of phpstrom thats break VPN. Because it happens “only” in 9/10 times ;-)
Hi Paul, thanks for the additional details.
I have not reproduced this, but I have a theory about what might be happening. When PhpStorm starts a compose-based dev container, it runs
docker compose up -d --force-recreate, which may be causing the issue in your setup.To check this, please close PhpStorm, connect to the VPN, and then run the following commands from the directory that holds your
devcontainer.json:Please run the first command twice. The second run should report that the container is already running, which gives us a clean baseline. Then run the second command with
--force-recreate. Please let me know whether the VPN connection survives each step.There is also a workaround worth testing. In File | Settings | Advanced Settings, under Dev Containers, enable Open devcontainer projects natively. In this mode, the IDE connects to the container directly instead of downloading and running a backend IDE inside it, so several short-lived helper containers are no longer started. This setting is disabled by default and is still in development, but it is worth trying.
After enabling it, close any currently open projects. Then, from the Welcome screen, go to Remote Development | Dev Containers, build a new dev container, and check whether this causes your VPN connection to drop.
Dear Petar Milunovic
docker compose up, even running twice or with ---force-recreate will not break my ipsec vpn, never!
dev container native mode never work for me. Obviously the IDE can't start the IDE backend or something.
Hi Paul, thanks for retesting.
So far, it is not clear to me what could be causing this issue. Could you please collect the IDE logs after reproducing it? They should give me a better idea of what is happening:
The IDE logs will not contain enough information about the network connection itself, so please also collect the system journal immediately after reproducing the issue:
Please add
vpn.txtto the same upload. The journal may contain system details such as IP addresses and hostnames, so you may want to review it before uploading. The uploaded files will be accessible only to JetBrains employees.To correlate the logs, please note:
Could you also answer the following questions?
devcontainer.json, or something else?Please reproduce the native-mode problem separately, after collecting the logs for the VPN disconnection, so the two runs do not become mixed together.
i am sorry, please forget it. I have edited my last post, it was not correct. When PhpStorm backend start the connection will be lost in the most cases (journalctl reported then a timeout to VPN gateway)
Hi Paul, got it, no worries.
I would like to test your theory next. If the VPN disconnects because of the system load generated while the backend starts and indexes the project, removing the indexing workload should help us confirm that.
Could you start your usual dev container with just one change: use a project containing no source files. Please keep everything else the same, including your usual
dockerComposeFile, image, and the method you normally use to start the container. Once the IDE opens, leave it idle for about five minutes. You reported that the disconnection can take some time, so a shorter run may not show it.Please let me know whether the VPN remains connected during this test. If it still disconnects, please try building a minimal dev container using a new project and a
devcontainer.jsonfile containing only animageproperty, preferably referencing an image that is already available locally.The IDE logs and a system journal excerpt covering the disconnection would still be useful if you are able to share them.
unbelievable! running a new dev container (also a new project) without source files with just the same .devcontainer directory don't interrupt my VPN. I've testet it minimum 20 times. Then i copyed also source files with “cp -a” to the new project an run the container again. Connection lost :)
Hi Paul, thanks for running that comparison.
It suggests that the trigger is the work the IDE performs on your source files, rather than the container startup itself. Also, the journal does not show heavy traffic through the VPN, so tunnel saturation does not appear to be the cause of the disconnection.
Two questions remain: which host resource is under pressure during this work, and whether the same problem occurs without a dev container.
Could you please run these two tests?
vmstat -t 1in your host terminal and leave it running. Stop it withCtrl-Conce the VPN disconnects. Then send the ~30 lines whose timestamps cover thexl2tpdtimeout shown in the journal.The first test will show whether dev containers are involved at all. If indexing the local project also disconnects the VPN, the cause lies elsewhere. The second should show which resource, if any, is under pressure.
Hello Petar Milunovic
Update: i don't need Docker or even a devcontainer to kill my VPN.
Its enought to invalidate PhpStorm Caches and start two Projects :-/
This is my perfomance stat from invalidate cache until ipsec timout
The pattern matches [IDEA-271811](https://youtrack.jetbrains.com/issue/IDEA-271811). PhpStorm's indexing threads are bound by a lock in the indexing storage layer, not by CPU or IO. Under that contention, the OS reschedules them across all cores.
Your vmstat run queue (15 to 25) and near-zero idle coincide with the moment journalctl logs the xl2tpd timeout. The working diagnosis: indexing saturates the host enough that pppd and xl2tpd miss their L2TP keepalive window, and NetworkManager tears down the tunnel. I have not reproduced this myself, so treat it as a diagnosis rather than a confirmed root cause.
I filed [IJPL-254492](https://youtrack.jetbrains.com/issue/IJPL-254492) for the VPN-specific symptom, linked to IDEA-271811. Watch IJPL-254492 for updates.
Two settings are worth testing. Add `caches.indexerThreadsCount=x` under **Help | Edit Custom Properties file**, or `-XX:ActiveProcessorCount=x` under **Help | Edit Custom VM Options**. Either needs an IDE restart.
Neither is a guaranteed fix. [IJPL-233429](https://youtrack.jetbrains.com/issue/IJPL-233429) shows indexerThreadsCount alone did not fully cap CPU for at least one other user. Try a different value, or combine both settings.
Hello Petru Basarab
interresting point, but I've had no success.
I've set
caches.indexerThreadsCount=2, cleared all caches and started two PhpStorm Projects again. VPN still timed out instantly. All 8 Cores are under full load.The network manager was terminated by signal 15 SIGTERM.
It is possible when IDE was indexing the project or docker containers were running, the system didn't have enough memory and killed some random processes.
Some Linux distributions use a service called systemd-oomd, which may terminate applications before the entire system reaches a certain memory usage threshold (for example, 75% of total RAM).
Based on your logs, I suspect that systemd-oomd may have killed the VPN.
You can run the command below to check whether the system terminated the VPN in your Linux when you lost the VPN connection.