Since somehow the kill switch was not working for me inside the docker container, I looked at the protonvpn-cli source code and saw they are using plain iptables as well. So I modified the entrypoint to block everything except to LAN and the proton0 device.

Keep in mind I have hardcoded my container subnet to 172.26.0.0/16 in my docker-compose.yml for this to work, but it should be very doable to fix this. I'm just providing this is a proof of concept, please let me know if I missed anything in the rules, from my understanding, this should block all traffic outside LAN on the main adapter and only allow that traffic through proton0.

iptables -P INPUT DROP
iptables -P FORWARD DROP
iptables -P OUTPUT DROP
iptables -A INPUT -i lo -j ACCEPT
iptables -A INPUT -i proton0 -j ACCEPT
iptables -A INPUT -i proton0 -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A INPUT -p udp -m udp --sport 1194 -j ACCEPT
iptables -A INPUT -s 172.26.0.0/16 -i eth0 -j ACCEPT
iptables -A INPUT -s 10.8.0.0/16 -i eth0 -j ACCEPT
iptables -A OUTPUT -o lo -j ACCEPT
iptables -A OUTPUT -o proton0 -j ACCEPT
iptables -A OUTPUT -o proton0 -m state --state RELATED,ESTABLISHED -j ACCEPT
iptables -A OUTPUT -p udp -m udp --dport 1194 -j ACCEPT
iptables -A OUTPUT -d 172.26.0.0/16 -o eth0 -j ACCEPT
iptables -A OUTPUT -d 10.8.0.0/16 -o eth0 -j ACCEPT

Since VPN users often do want their traffic to only go through the VPN tunnel, I imagine an environment variable might that triggers this might be useful maybe? I currently just have the above rules in the entrypoint script.