run tor as unprivileged user; DNS port 53 -> 9053 (breaking)

> [warn] You are running Tor as root. You don't need to, and you probably shouldn't.

CHANGELOG.md

@@ -5,6 +5,11 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ## [Unreleased]
+### Changed
+- Changed DNS port from 53 to 9053
+
+### Fixed
+- Run as unprivileged user
 
 ## [1.1.1] - 2020-03-21
 ### Fixed

Dockerfile

@@ -16,14 +16,16 @@ RUN adduser -S onion \
 # ENV PAGER=less
 
 EXPOSE 9050/tcp
-EXPOSE 53/udp
+EXPOSE 9053/udp
 COPY torrc.template entrypoint.sh /
 ENV SOCKS_TIMEOUT_SECONDS=
 ENTRYPOINT ["/entrypoint.sh"]
+RUN chmod -c a+rX /torrc.template /entrypoint.sh
 
-CMD ["tor"]
+USER onion
+CMD ["tor", "-f", "/tmp/torrc"]
 
 HEALTHCHECK CMD \
     curl --silent --socks5 localhost:9050 https://google.com > /dev/null \
-    && [ ! -z "$(dig +notcp +short one.one.one.one @localhost)" ] \
+    && [ ! -z "$(dig -p 9053 +notcp +short one.one.one.one @localhost)" ] \
     || exit 1

docker-compose.yml

@@ -6,12 +6,13 @@ services:
     image: fphammerle/tor-proxy
     ports:
     - '127.0.0.1:9050:9050/tcp'
-    - '127.0.0.1:53:53/udp'
+    - '127.0.0.1:53:9053/udp'
     environment:
       SOCKS_TIMEOUT_SECONDS: 240
     security_opt: ['no-new-privileges']
     restart: unless-stopped
     cpus: 0.5
     mem_limit: 128m
+    #cap_add: [SYS_PTRACE]
 
 # https://docs.docker.com/compose/compose-file/compose-file-v2/

entrypoint.sh

@@ -5,9 +5,9 @@ set -e
 # default: 120 sec
 # https://github.com/torproject/tor/blob/tor-0.4.1.7/src/core/or/connection_edge.c#L1099
 if [ -z "$SOCKS_TIMEOUT_SECONDS" ]; then
-    sed -e '/{socks_timeout_seconds}/d' /torrc.template > /etc/tor/torrc
+    sed -e '/{socks_timeout_seconds}/d' /torrc.template > /tmp/torrc
 else
-    sed -e "s/{socks_timeout_seconds}/$SOCKS_TIMEOUT_SECONDS/" /torrc.template > /etc/tor/torrc
+    sed -e "s/{socks_timeout_seconds}/$SOCKS_TIMEOUT_SECONDS/" /torrc.template > /tmp/torrc
 fi
 
 exec "$@"

torrc.template

@@ -1,7 +1,7 @@
 Log notice stdout
 
 SocksPort 0.0.0.0:9050
-DNSPort 0.0.0.0:53
+DNSPort 0.0.0.0:9053
 
 SocksTimeout {socks_timeout_seconds}