As my followers well know, by now, I am a tinkerer at heart. Why do I do things ? No one knows ! I don't even know.
All I know, all I can tell you is that I like to see what can I do with the tools I have at hand. How can I bend them to my will.
Why, you may ask. The answer is a bit complicated; part of who I am, part of what I do as a DevOps. End line is, this time I was curious.
I went down a road that taught me so much more about _containers_, _docker_, _docker-compose_ and even _Linux_ itself.
The question I had was simple, **can I run a container only through Tor running in another container?**
<!--more-->
## Tor {#tor}
I usually like to start topics that I haven't mentioned before with definitions. In this case, what is [Tor](https://2019.www.torproject.org/index.html.en), you may ask ?
> Tor is free software and an open network that helps you defend against traffic analysis, a form of network surveillance that threatens personal freedom and privacy, confidential business activities and relationships, and state security.
Although that _home_ page is obscure because it was replaced by the new _design_ of the website.
Although I love what **Tor** has done with all the services they offer, don't get me wrong.
But giving so much importance on the browser only and leaving the rest for dead when it comes to website, I have to say, I'm a bit sad.
Anyway, let's share the love for **Tor** and thank them for the beautiful project they offered humanity.
Now that we thanked them, let's abuse it.
### Tor in a container {#tor-in-a-container}
The task I set to discover relied on **Tor** being containerized.
The first thing I do is, simply, not re-invent the wheel.
Let's find out if someone already took that task.
With a litte bit of search, I found the [dperson/torproxy](https://hub.docker.com/r/dperson/torproxy) docker image.
It isn't ideal but I _believe_ it is written to be rebuilt.
Can we run it ?
```bash
docker run -it -p 127.0.0.1:8118:8118 -d dperson/torproxy
```
```bash
curl -Lx http://localhost:8118 http://jsonip.com/
```
And this is **definitely** not your IP. Don't take _my word_ for it!
Go to [http://jsonip.com/](http://jsonip.com/) in a browser and see for yourself.
Now that we **know** we can run **Tor** in a container effectively, let's kick it up a _notch_.
## docker-compose {#docker-compose}
I will be _testing_ and making changes as I go along. For this reason, it's a good idea to use [docker-compose](https://docs.docker.com/compose/) to do this.
> Compose is a tool for defining and running multi-container Docker applications. With Compose, you use a YAML file to configure your application’s services. Then, with a single command, you create and start all the services from your configuration.
_Now_ that we saw what the **docker** team has to say about **docker-compose**, let's go ahead and use it.
First, let's implement what we just ran _ad-hoc_ in **docker-compose**.
```yaml
---
version: '3.9'
services:
torproxy:
image: dperson/torproxy
container_name: torproxy
restart: unless-stopped
```
## Air-gapped container {#air-gapped-container}
The next piece of the puzzle is to figure out **if** and **how** can we create an _air-gapped container_.
It turns out, we can create an `internal` network in _docker_ that has no access to the internet.
First, the _air-gapped container_.
```yaml
air-gapped:
image: ubuntu
container_name: air-gapped
restart: unless-stopped
command:
- bash
- -c
- sleep infinity
networks:
- no-internet
```
Then comes the network.
```yaml
networks:
no-internet:
driver: bridge
internal: true
```
Let's put it all together in a `docker-compose.yaml` file and run it.
```bash
docker-compose up -d
```
Keep that terminal open, and let's put the _hypothesis_ to the test and see if rises up to be a _theory_.
