release v3.0.0

https://github.com/fphammerle/docker-tor-obfs4-bridge/commit/8d6514c2bda98488876f67116aa4c306a9dc28c2
https://github.com/fphammerle/docker-onion-service/commit/345840bda88620983bbf3d0f9a2975b561101ffc

CHANGELOG.md

@@ -6,32 +6,44 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [3.0.0] - 2020-10-03
+### Added
+- create mount point at `/var/lib/tor`
+  to be able to make container's root filesystem read-only
+
+### Changed
+- moved tor's data directory from `/home/onion/.tor` to `/var/lib/tor`
+- run `tor` as user `tor` (uid=100) instead of `onion` (uid=101)
+- docker-compose & ansible-playbook: read-only root filesystem
+
+### Fixed
+- ansible-playbook: drop capabilities
+
 ## [2.1.0] - 2020-09-27
 ### Added
-- Enable [Tor control](https://gitweb.torproject.org/torspec.git/tree/control-spec.txt)
+- enable [tor control](https://gitweb.torproject.org/torspec.git/tree/control-spec.txt)
   listener on port `9051`
   (listening on loopback device only)
 
 ## [2.0.0] - 2020-03-24
 ### Changed
-- Changed DNS port from 53 to 9053
-
-### Fixed
-- Run as unprivileged user
+- changed DNS port from 53 to 9053
+- run as unprivileged user
 
 ## [1.1.1] - 2020-03-21
 ### Fixed
-- Fix invalid torrc path
+- fix invalid torrc path
 
 ## [1.1.0] - 2020-03-21
 ### Added
-- Change `SocksTimeout` option by setting `$SOCKS_TIMEOUT_SECONDS`
+- change `SocksTimeout` option by setting `$SOCKS_TIMEOUT_SECONDS`
 
 ## [1.0.0] - 2019-10-12
 ### Added
-- Tor Socks5 & DNS proxy
+- tor socks5 & DNS proxy
 
-[Unreleased]: https://github.com/fphammerle/docker-tor-proxy/compare/v2.1.0...HEAD
+[Unreleased]: https://github.com/fphammerle/docker-tor-proxy/compare/v3.0.0...HEAD
+[3.0.0]: https://github.com/fphammerle/docker-tor-proxy/compare/v2.1.0...v3.0.0
 [2.1.0]: https://github.com/fphammerle/docker-tor-proxy/compare/v2.0.0...v2.1.0
 [2.0.0]: https://github.com/fphammerle/docker-tor-proxy/compare/v1.1.1...v2.0.0
 [1.1.1]: https://github.com/fphammerle/docker-tor-proxy/compare/v1.1.0...v1.1.1

Dockerfile

@@ -1,13 +1,13 @@
 FROM alpine:3.12
 
-ARG CURL_PACKAGE_VERSION=7.69.1-r0
+ARG CURL_PACKAGE_VERSION=7.69.1-r1
 ARG BIND_TOOLS_PACKAGE_VERSION=9.16.6-r0
 ARG TOR_PACKAGE_VERSION=0.4.3.5-r0
-RUN adduser -S onion \
-    && apk add --no-cache \
+RUN apk add --no-cache \
         curl=$CURL_PACKAGE_VERSION \
         bind-tools=$BIND_TOOLS_PACKAGE_VERSION `# dig` \
         tor=$TOR_PACKAGE_VERSION
+VOLUME /var/lib/tor
 
 #RUN apk add --no-cache \
 #        less \
@@ -18,11 +18,11 @@ RUN adduser -S onion \
 EXPOSE 9050/tcp
 EXPOSE 9053/udp
 COPY torrc.template entrypoint.sh /
+RUN chmod -c a+rX /torrc.template /entrypoint.sh
 ENV SOCKS_TIMEOUT_SECONDS=
 ENTRYPOINT ["/entrypoint.sh"]
-RUN chmod -c a+rX /torrc.template /entrypoint.sh
 
-USER onion
+USER tor
 CMD ["tor", "-f", "/tmp/torrc"]
 
 HEALTHCHECK CMD \

README.md

@@ -16,7 +16,8 @@ or after cloning the repository 🐙
 $ sudo docker-compose up
 ```
 
-test proxies:
+### test proxies
+
 ```sh
 $ curl --proxy socks5h://localhost:9050 ipinfo.io
 $ torsocks wget -O - ipinfo.io
@@ -27,17 +28,30 @@ $ ssh -o 'ProxyCommand nc -x localhost:9050 -v %h %p' abcdefghi.onion
 $ chromium-browser --proxy-server=socks5://localhost:9050 ipinfo.io
 ```
 
-isolate:
+### read-only root filesystem
+
+optionally add
+```sh
+$ sudo docker run --read-only -v tor_proxy_data:/var/lib/tor --tmpfs /tmp:rw,size=4k` …
+```
+to make the container's root filesystem read-only
+
+### isolate
+
 ```sh
 sudo iptables -A OUTPUT ! -o lo -j REJECT --reject-with icmp-admin-prohibited
 ```
 
-change `SocksTimeout` option:
+### change `SocksTimeout` option
+
 ```sh
 $ sudo docker run -e SOCKS_TIMEOUT_SECONDS=60 …
 ```
 
-show circuits:
+### show circuits
+
 ```sh
-$ sudo docker exec tor_proxy sh -c 'printf "AUTHENTICATE\nGETINFO circuit-status\n" | nc localhost 9051'
+$ sudo docker exec tor_proxy \
+    sh -c 'printf "AUTHENTICATE\nGETINFO circuit-status\nQUIT\n" | nc localhost 9051'
 ```
+relay search: https://metrics.torproject.org/rs.html

ansible-playbook.yml

@@ -7,16 +7,29 @@
         com.docker.network.bridge.name: tor
   - docker_container:
       name: tor_proxy
-      # 1.0.0-tor0.4.1.6-amd64
-      image: fphammerle/tor-proxy@sha256:ad55d07b1b21c35fa044dc3e1ea6c7d8494f39eb89491ddad35c245340f7cd4b
+      # TODO use fingerprint
+      image: fphammerle/tor-proxy:3.0.0-tor0.4.3.5-amd64
+      mounts:
+      - type: volume
+        source: tor_proxy_data
+        target: /var/lib/tor
+        read_only: no
+      - type: tmpfs
+        target: /tmp # torrc
+        # nosuid,nodev,noexec added by default
+        tmpfs_mode: '1777'
+        tmpfs_size: 4k
+      read_only: yes
       networks:
       - name: tor_proxy_network
       purge_networks: yes
       ports:
       - '127.0.0.1:9050:9050/tcp'
       - '127.0.0.1:53:9053/udp'
-      restart_policy: unless-stopped
+      cap_drop: [ALL]
+      security_opts: [no-new-privileges]
       memory: 128M
+      restart_policy: unless-stopped
   - iptables:
       action: append
       table: filter

docker-compose.yml

@@ -1,14 +1,29 @@
-version: '2.2'
+version: '2.3'
+
+volumes:
+  data:
 
 services:
   tor_proxy:
     build: .
     image: fphammerle/tor-proxy
+    environment:
+      SOCKS_TIMEOUT_SECONDS: 30
+    volumes:
+    - type: volume
+      source: data
+      target: /var/lib/tor
+      read_only: no
+    - type: tmpfs
+      target: /tmp # torrc
+      tmpfs:
+        # nosuid,nodev,noexec added by default
+        mode: '1777'
+        size: 4k
+    read_only: yes
     ports:
     - '127.0.0.1:9050:9050/tcp'
     - '127.0.0.1:53:9053/udp'
-    environment:
-      SOCKS_TIMEOUT_SECONDS: 240
     cap_drop: [ALL]
     #cap_add: [SYS_PTRACE]
     security_opt: [no-new-privileges]

torrc.template

@@ -1,5 +1,8 @@
 Log notice stdout
 
+# default: ~/.tor
+DataDirectory /var/lib/tor
+
 # https://gitweb.torproject.org/torspec.git/tree/control-spec.txt
 ControlPort localhost:9051