The dependable pattern is to run your web server and Tor on the same Docker network, point Tor’s HiddenServicePort at the web server’s Docker service name and port, and store HiddenServiceDir in a protected, persistent volume. Start with a working website, let Tor generate a v3 hostname, read that hostname from the volume, and test it in Tor Browser.
The Tor Project documents the onion-service settings, key handling and testing process, but it does not prescribe a Docker image, Compose file, volume layout or container topology. The Compose deployment below is therefore an implementation pattern, not an official Tor Project Docker recipe. Verify the image versions, package user and permissions in your own environment before putting it on the public internet.
As an Amazon Associate I earn from qualifying purchases.
What a Tor onion service does
An onion service publishes a TCP service inside the Tor network. Visitors connect to a generated address ending in .onion; they do not connect directly to your server’s public IP address. Tor terminates the onion connection and forwards the requested virtual port to the web server you specify.
Tor is not the web server. Your application still needs to listen on HTTP, serve files, handle application security and avoid disclosing identifying information. Tor supplies the onion rendezvous and forwarding layer.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
- Web container: serves the site on a normal HTTP listener.
- Tor container: creates the onion identity, publishes the onion descriptor and forwards virtual port 80 to the web container.
- Persistent state: holds the hostname and private service keys. Losing it creates a new onion address; exposing it can let someone impersonate the service.
Current onion services are v3. The Tor Project’s setup material describes a 56-character address before .onion and notes that v2 has not been supported since Tor 0.4.6.1-alpha in 2021.
“If your keys leak, other people can impersonate your Onion Service, deeming it compromised, useless, and dangerous to visit.”
That warning is why the state volume is a security boundary, not merely a cache.
Free tools Windows power users keep installed
One-click scans. No signup required.
Choose how Tor reaches the website
There are two sensible designs. Decide before writing HiddenServicePort, because the destination must be reachable from Tor’s own network namespace.
| Design | Tor destination | Advantages | Costs and checks |
|---|---|---|---|
| Separate containers on one private Docker network | A Docker service name and port, such as web:80 |
Independent upgrades, smaller responsibilities per container and straightforward Compose management | Tor must resolve the service name; do not use 127.0.0.1, which means the Tor container itself. The web container is reachable by every process attached to that Docker network unless you isolate the network. |
| Tor and web server in one container, or a deliberately shared Unix-socket volume | A local listener or shared socket path | A Unix socket avoids putting the HTTP listener on a container network and can reduce unintended local-network exposure | Processes must share a filesystem path and compatible ownership and permissions. A combined container has less separation and more complicated lifecycle management. |
The Tor Project describes Unix sockets as good practice when you want to avoid exposing the onion service to a local network. The separate-container example in this article uses TCP on an internal Docker network because it is easier to inspect and maintain. It publishes no web port on the host.
Prerequisites and a local website test
- A Linux host, Docker Engine and the Docker Compose plugin.
- A directory in which you can create a Compose project and a persistent Docker volume.
- A website that already works before Tor is introduced.
- Tor Browser on a client machine for the final test. A normal browser will not resolve an onion address through an ordinary internet connection.
The Tor Project’s examples use Debian-oriented package commands and paths, but operating systems and installations differ. In a container, use the paths in the image you build rather than copying host package instructions.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
Test the site before adding Tor
Make a temporary local-only publication of the web container while you test it. In the Compose file below, temporarily add this under the web service:
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesports:
- "127.0.0.1:8080:80"Start only the web service and request http://127.0.0.1:8080 from the Docker host. Confirm the expected page, application routes and static assets work. Remove the temporary ports section before exposing the onion service. Leaving it in place would create a separate clearnet entry point.
A separate-container Docker deployment
The following project builds a small Tor image, runs an Nginx web container, attaches both to one private network and stores Tor’s state in a named volume. The exact base image and package versions are implementation choices; pin and update them according to your normal image-maintenance policy.
1. Create the project layout
mkdir -p onion-site/tor onion-site/site
cd onion-siteThe resulting files are:
onion-site/
├── compose.yaml
├── site/
│ └── index.html
└── tor/
├── Dockerfile
├── entrypoint.sh
└── torrc2. Add a test page
Put your real site in site/. For a first smoke test, create site/index.html:
<!doctype html>
<html lang="en">
<head>
<meta charset="utf-8">
<title>Onion service test</title>
</head>
<body>
<h1>The Docker web container is working</h1>
</body>
</html>3. Build the Tor image
Create tor/Dockerfile:
FROM debian:bookworm-slim
RUN apt-get update
&& apt-get install -y --no-install-recommends tor ca-certificates
&& rm -rf /var/lib/apt/lists/*
COPY torrc /etc/tor/torrc
COPY entrypoint.sh /usr/local/bin/tor-entrypoint
RUN chmod 0755 /usr/local/bin/tor-entrypoint
ENTRYPOINT ["/usr/local/bin/tor-entrypoint"]This build deliberately installs Tor rather than assuming a particular third-party Tor image. Use a maintained base image, review package updates and pin a digest for production deployments.
4. Configure Tor
Create tor/torrc:
RunAsDaemon 0
User debian-tor
SocksPort 0
DataDirectory /var/lib/tor
HiddenServiceDir /var/lib/tor/onion
HiddenServicePort 80 web:80
Log notice stdoutHiddenServiceDir is where Tor writes the service identity, hostname and keys. HiddenServicePort 80 web:80 maps onion port 80 to port 80 of the Compose service named web. Both services must be on the same Docker network. In a separate-container design, replacing web:80 with 127.0.0.1:80 points back to the Tor container and normally fails.
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
The official example often uses 127.0.0.1:80 because Tor and the web server are on the same host and listener namespace. That address is not automatically correct when the processes are in separate containers.
5. Set ownership safely at startup
Create tor/entrypoint.sh:
#!/bin/sh
set -eu
install -d /var/lib/tor /var/lib/tor/onion
chown -R debian-tor:debian-tor /var/lib/tor
chmod 0700 /var/lib/tor /var/lib/tor/onion
exec tor -f /etc/tor/torrcThe Debian package creates the debian-tor account. The entrypoint runs as root only long enough to prepare the mounted volume, then Tor drops privileges to that account because of the User line in torrc. If you use a different base image, confirm its Tor account name and change both files together.
6. Define the Compose services
Create compose.yaml:
services:
web:
image: nginx:stable
restart: unless-stopped
volumes:
- ./site:/usr/share/nginx/html:ro
networks:
- onion
tor:
build: ./tor
restart: unless-stopped
depends_on:
- web
volumes:
- tor-state:/var/lib/tor
networks:
- onion
volumes:
tor-state:
networks:
onion:There is intentionally no ports: entry. Docker’s internal DNS resolves web for the Tor container, while the host has no published HTTP listener. The named volume remains when ordinary containers are recreated. docker compose down -v, deleting the volume manually or replacing it with an empty volume destroys the onion identity.
7. Start and inspect the stack
- Build the Tor image and start both services:
docker compose up -d --build - Check container state:
docker compose ps - Watch Tor’s foreground log while it bootstraps:
docker compose logs -f torSuccessful startup should include normal Tor bootstrap progress rather than a configuration, permission or connection error.
- Confirm the web container’s configuration is valid:
docker compose exec web nginx -t - Verify that the Tor container can resolve the Docker service name:
docker compose exec tor getent hosts webIf this returns no address, check that both services are attached to the
onionnetwork and restart the stack.
Tor may need time to connect to the Tor network. Do not expect the hostname file immediately after the container starts.
Find and test the onion address
Once Tor has created the service, read the hostname from the persistent directory:
docker compose exec tor cat /var/lib/tor/onion/hostnameCopy the complete value, including .onion. A v3 address has 56 characters before that suffix. Open it in Tor Browser. Test the home page, application routes, forms, assets and any WebSocket or upload features your site needs; an onion connection can expose proxy assumptions that a local HTTP test does not.
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
If the hostname file exists but the page does not load, keep Tor Browser open and inspect the Tor log in another terminal:
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutedocker compose logs --tail=200 torThen check the web service from inside its container and verify that the destination in HiddenServicePort matches the listener. A container restart can change a web container’s internal IP, but Docker’s service name is designed to resolve the current endpoint. Restart Tor after changing the service name, network or listener.
Keep the address when containers change
The hostname is derived from the onion service’s private keys. The named tor-state volume is therefore part of the service identity.
docker compose restartand a normaldocker compose downpreserve the address because the volume remains.docker compose down -vremoves the volume and causes the next Tor instance to generate a different address.- Back up the volume only through an access-controlled process. A backup containing the service keys must be treated like the live keys.
- Do not bind the state directory into a broadly readable host path. Restrict host permissions and Docker access to administrators who need the keys.
After any restore, run docker compose exec tor cat /var/lib/tor/onion/hostname and compare it with the address you advertise. Never assume a restore succeeded merely because the container is running.
Common failures and fixes
The hostname file is missing
- Read the Tor log for a malformed
torrc, an unwritableHiddenServiceDiror a failure to start. - Confirm that the volume is mounted at
/var/lib/torand that the entrypoint creates/var/lib/tor/onion. - Check that the package really provides the
debian-toraccount if you changed the base image. - Allow time for Tor to bootstrap, then restart only the Tor service after correcting the error.
Tor starts but cannot reach the site
- Use
docker compose exec tor getent hosts webto test Docker DNS. - Ensure the web process listens on the container’s network interface and port 80, not only on an unavailable host-only address.
- Use
web:80for this Compose design. Do not substitute127.0.0.1:80unless Tor and the web server share the same network namespace. - Run
docker compose exec web nginx -tand inspectdocker compose logs web.
The onion opens in no browser
- Use Tor Browser or another client configured to use Tor; ordinary browsers do not resolve
.onionthrough normal DNS. - Check that you copied the entire hostname and did not add spaces or punctuation.
- Read the Tor log for bootstrap, descriptor publication or permission errors.
- Test from a second Tor client to distinguish a client-side problem from a service-side problem.
The address changed unexpectedly
Find out whether the state volume was removed, renamed or replaced. Restore the original volume containing the service keys. If those keys are gone, the old address cannot be recovered by editing the hostname file; a new service identity has been created.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →The site is reachable on the host when it should not be
Inspect the Compose configuration for a ports mapping and remove it unless you intentionally need a separate clearnet endpoint. A Docker network connection from Tor to the web container does not require publishing the web port on the host.
Public access versus client authorization
By default, anyone who knows or discovers the onion address can request the site. An onion address is not an access-control mechanism.
For a private v3 service, Tor client authorization uses keys. The service is configured with an authorization public key, and an authorized client receives the corresponding private credential. Clients without authorization cannot connect once authorization is enabled. Store client credentials separately from the server’s service keys, distribute them through a secure channel and revoke or replace them when a client is no longer trusted.
The exact authorization file format and commands depend on the Tor version and packaging. Apply the current Tor client-authorization instructions to the persistent service directory, then restart Tor and test with both an authorized and an unauthorized Tor Browser profile. Do not enable authorization merely by hiding the hostname; secrecy of an address is weaker than cryptographic authorization.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Optional Onion-Location discovery
A public website can advertise its onion counterpart with the Tor Project’s Onion-Location mechanism. This is separate from creating the onion service: the onion must already work, and the public page can then send an Onion-Location HTTP header or an equivalent HTML meta attribute pointing to the generated onion address.
The guidance has two important conditions: the page carrying the hint must be served over HTTPS, and it must not itself be an onion site. Treat the hint as a convenience for discovery, not as a redirect or an access-control feature. Confirm the generated address and HTTPS configuration before adding it.
Operational security beyond the container
Onion routing does not automatically make an application anonymous. Review the entire stack for identifying information:
- Remove server banners, debug traces, hostnames and absolute filesystem paths from responses.
- Check uploaded files, images, PDFs, analytics scripts and third-party resources for metadata or external requests that reveal an operator or location.
- Keep the web application, dependencies, container base images and Tor package patched.
- Separate administrative interfaces from the public onion service and require strong authentication.
- Monitor logs without publishing them through the website, and protect log files because they may contain visitor or operational data.
- Use the Tor Project’s operational-security guidance and OnionScan as review references; hosting the site as an onion service alone does not prevent application or server misconfiguration from identifying you.
Decide whether the service should be publicly discoverable before you publish its address. A public site can be indexed or shared even though it is not reachable through ordinary DNS.
Recommended Free Tools
When a Unix socket is the better design
If avoiding a local TCP path is a priority, place Tor and the web server in one container or give both containers a dedicated shared runtime volume. Configure the web server to listen on a Unix socket in that volume and configure HiddenServicePort to target the socket path using the syntax supported by your Tor version.
This approach is more than changing one line: both containers need the socket volume, the web process must be able to create the socket, the Tor process must be able to read and connect to it, and the socket directory must not be writable by unrelated users. Test creation after every restart. If you cannot verify those ownership and lifecycle details, the separate-network recipe is easier to audit; keep that network private and publish no host port.
Quick Recap
Deployment checklist
- The website works locally before Tor is added.
HiddenServiceDirpoints to the persistent volume and is readable only by Tor.HiddenServicePortnames the actual reachable web listener for your topology.- Both containers share the intended private Docker network.
- No accidental host
portsmapping exposes the web server. - Tor logs show normal startup and network bootstrap.
- The hostname was read from the live volume and tested in Tor Browser.
- The state volume and its backups are protected like private keys.
- You have decided explicitly whether the service is public or requires client authorization.
- Application responses and assets do not reveal identifying infrastructure or make unintended external requests.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
