Running a SOCKS Proxy for the Tor Onion Network in a Container

2026-01-05

Introduction

Containerizing the Tor proxy provides an isolated and flexible environment to access the Tor onion network securely. This setup allows you to route your application traffic through the Tor network while maintaining privacy and anonymity. Building on the concepts from running OpenSSH Client as a SOCKS Proxy, this post demonstrates how to configure and run a SOCKS proxy with Tor in a containerized environment.

The Architecture: How Tor and SOCKS Proxying Works

The Tor network uses onion routing to anonymize internet traffic by encrypting data in multiple layers and routing it through a series of volunteer-operated relay nodes. Typically, Tor routes your traffic through three relays: an entry node (guard), a middle relay, and an exit node. Each relay only knows about its immediate predecessor and successor in the chain, making it difficult to trace the connection back to its origin. When you configure an application to use the Tor SOCKS proxy, you're directing it to send its network traffic through this anonymization network. Unlike a direct SSH tunnel to a single remote server, the Tor proxy routes your traffic through these multiple relays before reaching its destination, providing strong anonymity guarantees.

Application (e.g., Browser)
↓
Local SOCKS Socket
↓
Tor Proxy (in Container)
↓ [Encrypted Onion Layers]
Entry Relay → Middle Relay → Exit Relay
↓
Final Destination (e.g., example.com or example.onion)

Why Containerize Tor?

Running Tor in a Docker or Podman container offers several advantages:

Setting Up the Tor Proxy

I've created a ready-to-use Dockerfile and comprehensive documentation for running Tor as a SOCKS proxy in a container. The repository includes everything you need to build and run the container, along with configuration examples.

Check out the full implementation on GitHub: Tor Proxy Dockerfile and Documentation

Configuration is managed through files located in the tor/ folder, allowing you to customize various aspects of the Tor proxy behavior. After making changes to the configuration files, rebuild the container to apply your updates.

Configuring the Proxy

The Tor proxy configuration supports various customization options, such as:

The repository's README provides detailed examples of common configuration scenarios. Remember that any configuration changes require rebuilding the container to take effect.

Testing the SOCKS Proxy

Once your container is running, you can verify the SOCKS proxy's functionality using the curl command-line tool to check your IP address and confirm that traffic is routed through the Tor network: 

curl -x socks5h://127.0.0.1:9050 https://check.torproject.org/api/ip

The socks5h protocol specification is important here: the h ensures that DNS resolution occurs remotely via the Tor proxy rather than on your local machine, preventing DNS leaks that could compromise your anonymity.

You can also configure your browser to use the SOCKS v5 proxy available on host 127.0.0.1 and port 9050. For Firefox users, follow these instructions to configure the proxy settings. After configuration, visit check.torproject.org to verify your connection through the Tor network and confirm that your IP address appears as a Tor exit node.

Practical Applications

This containerized Tor proxy setup is useful for several scenarios:

Tunneling SSH Through Tor

Beyond web browsing, you can tunnel SSH connections through your containerized Tor proxy to hide the origin of SSH connections. This is accomplished by instructing the SSH client to connect through the local Tor SOCKS proxy using the ProxyCommand directive with netcat: 

ssh -o ProxyCommand="nc -X 5 -x localhost:9050 %h %p" fred@server.example.org

When tunneling SSH through Tor, it's critical to prevent DNS leaks. Ensure that VerifyHostKeyDNS is set to 'no' to prevent DNS lookups from occurring outside the Tor network: 

ssh -o VerifyHostKeyDNS=no -o ProxyCommand="nc -X 5 -x localhost:9050 %h %p" server.example.org

For more details on tunneling SSH through Tor, see the OpenSSH Cookbook section on SSH over Tor.

Managing the Container

You can easily control the Tor proxy container using standard Docker or Podman commands. The repository documentation includes commands for starting, stopping, viewing logs, and removing the container when it's no longer needed. This gives you complete control over when and how the Tor proxy runs on your system.

Alternative Approaches

While running a SOCKS proxy through your containerized Tor setup provides flexibility and control, you might consider the dedicated Tor Browser for general web browsing. The Tor Browser is specifically designed to integrate seamlessly with the Tor network, offering built-in privacy protections, optimized performance, and automatic security updates. It includes crucial features like fingerprinting resistance and automatic HTTPS upgrading that may not be present in standard browsers configured to use a Tor SOCKS proxy. Importantly, the Tor Browser automatically routes all traffic, including DNS requests, through the Tor network without requiring manual SOCKS proxy configuration, eliminating the risk of DNS leaks or other information leakage.

For users requiring maximum security, distributions like Whonix or Tails provide comprehensive privacy-focused operating systems. Whonix uses a two-VM architecture to prevent IP leaks, while Tails is a live operating system that leaves no trace on the computer you use. Both come with privacy-centric tools pre-installed and automatically route all traffic through Tor without requiring application-level configuration. This system-wide approach eliminates common pitfalls like DNS leaks that can occur when manually configuring applications to use a SOCKS proxy, making them excellent choices for anyone prioritizing digital security and anonymity.

Important Security Considerations

While Tor provides strong anonymity, it's important to understand its limitations:

For sensitive activities, combining this containerized Tor proxy with additional operational security practices is recommended. The simplest way to avoid configuration errors is to use the Tor Browser or privacy-focused operating systems like Whonix or Tails.

Conclusion

Running a SOCKS proxy for the Tor onion network in a container provides a robust and flexible method for anonymous internet access. By leveraging the Tor network's three-relay architecture and privacy features alongside the isolation and reproducibility of container technology, you can safely manage your internet connections while protecting your identity. This approach is particularly valuable for developers and researchers who need granular control over their Tor configuration, or for users who want to route specific applications through Tor while maintaining normal browsing for others.

For detailed instructions and the complete implementation, explore the GitHub repository: Tor Proxy Dockerfile and Documentation.