Running Tor relay inside a docker container
The latest Tor project release is 0.3.2.10. But,
that is not available on all the different versions of different Linux
distributions. For example, CentOS 7 has tor-0.2.9.14-1.el7
, and only Fedora
28 has the latest Tor.
This is where a container can help. The official builds from Tor Project are for Debian, means we can build and use a Debian based container.
The Dockerfile
FROM debian:stretch
LABEL MAINTAINER Kushal Das <mail@kushaldas.in>
RUN apt-get update
RUN apt install vim gpg -y
RUN echo "deb http://deb.torproject.org/torproject.org stretch main\ndeb-src http://deb.torproject.org/torproject.org stretch main" > /etc/apt/sources.list.d/tor.list
# Let us get the key for Tor
RUN gpg --keyserver keys.gnupg.net --recv A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89
RUN gpg --export A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89 > tor.gpg
RUN apt-key add tor.gpg
# Finally install Tor
RUN apt update
RUN apt install tor deb.torproject.org-keyring -y
ADD ./torrc /etc/tor/torrc
# Add the tor user
RUN groupadd -g 1000 tor && useradd -m -d /home/tor -g 1000 tor
# Now drop to the actual user
USER tor
RUN mkdir -p /home/tor/.tor/keys
VOLUME ["/home/tor/.tor"]
EXPOSE 9001 9051
ENTRYPOINT ["tor"]
I have a configuration file named torrc
, you can copy the sample
configuration
and edit as required. I have the following entries there.
SOCKSPort 0
ORPort 9001
Nickname NICKNAME_FOR_THE_RELAY
ContactInfo <YOUR_EMAIL_ADDRESS>
ExitRelay 0
Next, we will create a directory in the host system to keep the keys, and other files. We want to restart the container and still have the same details, mounting a directory from the host system into the container will help us in that.
mkdir /mnt/tor
chcon -R -t svirt_sandbox_file_t /mnt/tor
Please also make sure that you have correct ownership of that directory.
Running the container
docker run -d -v /etc/localtime:/etc/localtime -v /mnt/tor:/home/tor/.tor --restart always -p 9001:9001 -name relay kushaldas/tor:0.3.2.10
After starting the container, you can check the logs for any error. If you can see the following message in the log, then it means that you configured the relay properly.
# docker logs -f relay
Self-testing indicates your ORPort is reachable from the outside.
The official relay guide
Tor project recently published an updated relay
guide for anyone
new to running a relay. Please go through that document first. If you need
help, there is a mailing
list of Tor
relay operators, and #tor
channel on OFTC IRC server is also very welcoming.