diff --git a/Makefile b/Makefile
index 9c49a0b..15a68e0 100644
--- a/Makefile
+++ b/Makefile
@@ -1,20 +1,32 @@
-DOCKER_IMAGE_NAME := docker.io/fphammerle/tor-proxy
-DOCKER_TAG_VERSION := $(shell git describe --match=v* --dirty | sed -e 's/^v//')
-TOR_PACKAGE_VERSION := $(shell grep -Po 'TOR_PACKAGE_VERSION=\K.+' Dockerfile | tr -d -)
-ARCH := $(shell arch)
-DOCKER_TAG_ARCH_SUFFIX_armv6l := armv6
-DOCKER_TAG_ARCH_SUFFIX_x86_64 := amd64
-DOCKER_TAG_ARCH_SUFFIX = ${DOCKER_TAG_ARCH_SUFFIX_${ARCH}}
-DOCKER_TAG = ${DOCKER_TAG_VERSION}-tor${TOR_PACKAGE_VERSION}-${DOCKER_TAG_ARCH_SUFFIX}
+IMAGE_NAME := docker.io/fphammerle/tor-proxy
+PROJECT_VERSION = $(shell git describe --match=v* --abbrev=0 --dirty | sed -e 's/^v//')
+TOR_PACKAGE_VERSION = $(shell grep -Po 'TOR_PACKAGE_VERSION=\K.+' Dockerfile | tr -d -)
+ARCH = $(shell arch)
+# architecture[arm_variant]
+# https://github.com/opencontainers/image-spec/blob/v1.0.1/image-index.md#image-index-property-descriptions
+IMAGE_TAG_ARCH_aarch64 = arm64
+IMAGE_TAG_ARCH_armv6l = armv6
+IMAGE_TAG_ARCH_armv7l = armv7
+IMAGE_TAG_ARCH_x86_64 = amd64
+IMAGE_TAG_ARCH = ${IMAGE_TAG_ARCH_${ARCH}}
+IMAGE_TAG = ${PROJECT_VERSION}-tor${TOR_PACKAGE_VERSION}-${IMAGE_TAG_ARCH}
+BUILD_PARAMS = --tag="${IMAGE_NAME}:${IMAGE_TAG}" \
+	--build-arg=REVISION="$(shell git rev-parse HEAD)"
 
-.PHONY: docker-build docker-push
+.PHONY: worktree-clean docker-build podman-build docker-push
 
-docker-build:
+worktree-clean:
 	git diff --exit-code
 	git diff --staged --exit-code
-	sudo docker build -t "${DOCKER_IMAGE_NAME}:${DOCKER_TAG}" .
+
+docker-build: worktree-clean
+	sudo docker build ${BUILD_PARAMS} .
+
+podman-build: worktree-clean
+	# --format=oci (default) not fully supported by hub.docker.com
+	# https://github.com/docker/hub-feedback/issues/1871#issuecomment-748924149
+	podman build --format=docker ${BUILD_PARAMS} .
 
 docker-push: docker-build
-	sudo docker push "${DOCKER_IMAGE_NAME}:${DOCKER_TAG}"
-	sleep 2 # wait for repo digest
-	@echo git tag --sign --message '$(shell sudo docker image inspect --format '{{join .RepoDigests "\n"}}' "${DOCKER_IMAGE_NAME}:${DOCKER_TAG}")' docker/${DOCKER_TAG} $(shell git rev-parse HEAD)
+	sudo docker push "${IMAGE_NAME}:${IMAGE_TAG}"
+	@echo git tag --sign --message '$(shell sudo docker image inspect --format '{{join .RepoDigests "\n"}}' "${IMAGE_NAME}:${IMAGE_TAG}")' docker/${IMAGE_TAG} $(shell git rev-parse HEAD)
diff --git a/torrc.template b/torrc.template
index 144535a..5c79cef 100644
--- a/torrc.template
+++ b/torrc.template
@@ -22,6 +22,7 @@ SocksTimeout {socks_timeout_seconds}
 # https://gitlab.torproject.org/legacy/trac/-/wikis/doc/TransparentProxy
 # https://github.com/epidemics-scepticism/writing/blob/b6733379d653b30771d578ace04c262600345122/misconception.md#transparent-proxying-lacks-context
 # https://lists.torproject.org/pipermail/tor-talk/2014-March/032507.html
+# https://gitweb.torproject.org/tor.git/tree/src/or/connection_edge.c?id=6285d9bdcf7f210c56abd25f75133e30d05a7473#n1423
 # https://github.com/mitmproxy/mitmproxy/blob/v6.0.2/mitmproxy/platform/linux.py#L27
 TransPort 0.0.0.0:9040 IsolateClientAddr IsolateClientProtocol