lncm / docker-tor Goto Github PK

https://docs.github.com/en/packages/getting-started-with-github-container-registry/migrating-to-github-container-registry-for-docker-images#migrating-a-docker-image-using-the-docker-cli

https://twitter.com/torproject/status/1371872484773883904?s=21

Tor 0.4.4.7 is quite an important release because it fixes the cause of the recent tor issues.

@nolim1t I'd also recommend using make -j$(nproc) instead of make in the Dockerfile to speed up builds (On GitHub actions it would be -j2, but with more cores local builds could be even faster if anyone builds locally)

@lukechilds @mayankchhabra Is there any reason you're using your own image for Umbrel instead of this one? This image is build from source and gpg verified instead of using prebuilts, which makes it possible to update tor really easily without waiting for alpine to publish an update.

Update build key to be verified.

https://support.torproject.org/tbb/how-to-verify-signature/

When using the latest image (0.4.7.13) I get a permission error during startup:

[warn] Error creating directory /data/.tor: Permission denied
[warn] Failed to parse/validate config: Couldn't create private data directory "/data/.tor"

When switching back to an older image (0.4.7.9) everything works again. I really don't understand why the latest build tries to look in /data/.tor: when the mounted volumes are in /etc/tor and /var/lib/tor.

When doing a docker scan lncm/tor, the report throws out a LOT of critical vulnerabilities that need patching. At the bottom of the report, it recommends updating to Debian:11-slim to get rid of most of them

Project name:      docker-image|lncm/tor
Docker image:      lncm/tor
Platform:          linux/amd64
Base image:        debian:10.10-slim

**Tested 85 dependencies for known vulnerabilities, found 61 vulnerabilities.**

Base Image         Vulnerabilities  Severity
debian:10.10-slim  61               10 high, 6 medium, 45 low

Recommendations for base image upgrade:

Major upgrades
Base Image      Vulnerabilities  Severity
debian:11-slim  37               1 high, 2 medium, 34 low

Test out and build 0.4.5.6 tor release