+++ title = "Playing with containers and Tor" author = ["Elia el Lazkani"] date = 2021-06-21 lastmod = 2021-06-21 tags = ["docker", "linux", "ubuntu", "fedora", "proxy", "privoxy"] categories = ["container", "text-editors"] draft = false +++ As my followers well know, by now, I am a tinkerer at heart. Why do I do things ? No one knows ! I don't even know. All I know, all I can tell you is that I like to see what can I do with the tools I have at hand. How can I bend them to my will. Why, you may ask. The answer is a bit complicated; part of who I am, part of what I do as a DevOps. End line is, this time I was curious. I went down a road that taught me so much more about _containers_, _docker_, _docker-compose_ and even _Linux_ itself. The question I had was simple, **can I run a container only through Tor running in another container?** ## Tor {#tor} I usually like to start topics that I haven't mentioned before with definitions. In this case, what is [Tor](https://2019.www.torproject.org/index.html.en), you may ask ? > Tor is free software and an open network that helps you defend against traffic analysis, a form of network surveillance that threatens personal freedom and privacy, confidential business activities and relationships, and state security. Although that _home_ page is obscure because it was replaced by the new _design_ of the website. Although I love what **Tor** has done with all the services they offer, don't get me wrong. But giving so much importance on the browser only and leaving the rest for dead when it comes to website, I have to say, I'm a bit sad. Anyway, let's share the love for **Tor** and thank them for the beautiful project they offered humanity. Now that we thanked them, let's abuse it. ### Tor in a container {#tor-in-a-container} The task I set to discover relied on **Tor** being containerized. The first thing I do is, simply, not re-invent the wheel. Let's find out if someone already took that task. With a litte bit of search, I found the [dperson/torproxy](https://hub.docker.com/r/dperson/torproxy) docker image. It isn't ideal but I _believe_ it is written to be rebuilt. Can we run it ? ```bash docker run -it -p 127.0.0.1:8118:8118 -d dperson/torproxy ``` ```bash curl -Lx http://localhost:8118 http://jsonip.com/ ``` And this is **definitely** not your IP. Don't take _my word_ for it! Go to [http://jsonip.com/](http://jsonip.com/) in a browser and see for yourself. Now that we **know** we can run **Tor** in a container effectively, let's kick it up a _notch_. ## docker-compose {#docker-compose} I will be _testing_ and making changes as I go along. For this reason, it's a good idea to use [docker-compose](https://docs.docker.com/compose/) to do this. > Compose is a tool for defining and running multi-container Docker applications. With Compose, you use a YAML file to configure your application’s services. Then, with a single command, you create and start all the services from your configuration. _Now_ that we saw what the **docker** team has to say about **docker-compose**, let's go ahead and use it. First, let's implement what we just ran _ad-hoc_ in **docker-compose**. ```yaml --- version: '3.9' services: torproxy: image: dperson/torproxy container_name: torproxy restart: unless-stopped ``` ## Air-gapped container {#air-gapped-container} The next piece of the puzzle is to figure out **if** and **how** can we create an _air-gapped container_. It turns out, we can create an `internal` network in _docker_ that has no access to the internet. First, the _air-gapped container_. ```yaml air-gapped: image: ubuntu container_name: air-gapped restart: unless-stopped command: - bash - -c - sleep infinity networks: - no-internet ``` Then comes the network. ```yaml networks: no-internet: driver: bridge internal: true ``` Let's put it all together in a `docker-compose.yaml` file and run it. ```bash docker-compose up -d ``` Keep that terminal open, and let's put the _hypothesis_ to the test and see if rises up to be a _theory_. ```bash docker exec air-gapped apt-get update ``` Aaaaand... ```text Err:1 http://archive.ubuntu.com/ubuntu focal InRelease Temporary failure resolving 'archive.ubuntu.com' Err:2 http://security.ubuntu.com/ubuntu focal-security InRelease Temporary failure resolving 'security.ubuntu.com' Err:3 http://archive.ubuntu.com/ubuntu focal-updates InRelease Temporary failure resolving 'archive.ubuntu.com' Err:4 http://archive.ubuntu.com/ubuntu focal-backports InRelease Temporary failure resolving 'archive.ubuntu.com' Reading package lists... W: Failed to fetch http://archive.ubuntu.com/ubuntu/dists/focal/InRelease Temporary failure resolving 'archive.ubuntu.com' W: Failed to fetch http://archive.ubuntu.com/ubuntu/dists/focal-updates/InRelease Temporary failure resolving 'archive.ubuntu.com' W: Failed to fetch http://archive.ubuntu.com/ubuntu/dists/focal-backports/InRelease Temporary failure resolving 'archive.ubuntu.com' W: Failed to fetch http://security.ubuntu.com/ubuntu/dists/focal-security/InRelease Temporary failure resolving 'security.ubuntu.com' W: Some index files failed to download. They have been ignored, or old ones used instead. ``` looks like it's real peeps, **hooray** ! ## Putting everything together {#putting-everything-together} Okay, now let's put everything together. The list of changes we need to make are minimal. First, I will list them, then I will simply write them out in **docker-compose**. - Create an `internet` network for the **Tor** container - Attach the `internet` network to the **Tor** container - Attach the `no-internet` network to the **Tor** container so that our _air-gapped_ container can access it. Let's get to work. ```yaml --- version: '3.9' services: torproxy: image: dperson/torproxy container_name: torproxy restart: unless-stopped networks: - no-internet - internet air-gapped: image: ubuntu container_name: air-gapped restart: unless-stopped command: - bash - -c - sleep infinity networks: - no-internet networks: no-internet: driver: bridge internal: true internet: driver: bridge internal: false ``` Run everything. ```bash docker-compose up -d ``` Yes, this will run it in the background and there is **no** need for you to open another terminal. It's always _good_ to know **both** ways. Anyway, let's test. let's `exec` into the container. ```bash docker exec -it air-gapped bash ``` Then we configure `apt` to use our `torproxy` service. ```bash echo 'Acquire::http::Proxy "http://torproxy:8118/";' > /etc/apt/apt.conf.d/proxy echo "export HTTP_PROXY=http://torproxy:8118/" >> ~/.bashrc echo "export HTTPS_PROXY=http://torproxy:8118/" >> ~/.bashrc export HTTP_PROXY=http://torproxy:8118/ export HTTPS_PROXY=http://torproxy:8118/ apt-get update apt-get upgrade -y DEBIAN_FRONTEND=noninteractive apt-get install -y curl ``` ## Harvesting the fruits of our labour {#harvesting-the-fruits-of-our-labour} First, we **always** check if everything is set correctly. While inside the container, we check the _environment variables_. ```bash env | grep HTTP ``` You should see. ```text HTTPS_PROXY=http://torproxy:8118/ HTTP_PROXY=http://torproxy:8118/ ``` Then, we curl our **IP**. ```bash curl https://jsonip.com/ ``` And that is also not your **IP**. It works ! ## Conclusion {#conclusion} Is it possible to route a container through another **Tor** container ? The answer is _obviously_ **Yes** and this is the way to do it. Enjoy.