From 9770d2a2fa1a2445aab8cb39cca5fd702660a09c Mon Sep 17 00:00:00 2001
From: josh! <github@joshhighet.com>
Date: Wed, 8 Oct 2025 16:11:37 +1300
Subject: [PATCH 1/2] init

---
 .dockerignore |  3 +++
 config.toml   | 11 +++++++++++
 dockerfile    | 33 +++++++++++++++++++++++----------
 3 files changed, 37 insertions(+), 10 deletions(-)
 create mode 100644 .dockerignore
 create mode 100644 config.toml

diff --git a/.dockerignore b/.dockerignore
new file mode 100644
index 0000000..7444175
--- /dev/null
+++ b/.dockerignore
@@ -0,0 +1,3 @@
+.github
+target/
+*.DS_Store
\ No newline at end of file
diff --git a/config.toml b/config.toml
new file mode 100644
index 0000000..e47467c
--- /dev/null
+++ b/config.toml
@@ -0,0 +1,11 @@
+[proxy]
+socks_listen = "0.0.0.0:9050"
+
+[application]
+allow_running_as_root = true
+
+[bridge]
+enabled = false
+
+[logging]
+level = "warn"
diff --git a/dockerfile b/dockerfile
index 0ff28f2..49095d9 100644
--- a/dockerfile
+++ b/dockerfile
@@ -1,10 +1,23 @@
-FROM alpine:latest
-LABEL org.opencontainers.image.source https://github.com/joshhighet/torsocc
-RUN apk update
-RUN apk upgrade
-RUN apk add tor
-RUN echo 'SocksPort 0.0.0.0:9050' >> /etc/tor/torrc
-RUN chown -R tor /etc/tor
-USER tor
-ENTRYPOINT ["tor"]
-CMD ["-f", "/etc/tor/torrc"]
+FROM alpine:3.22 AS builder
+LABEL org.opencontainers.image.source="https://github.com/joshhighet/torsocc"
+RUN apk add --no-cache build-base git curl openssl-dev openssl-libs-static pkgconfig sqlite-dev sqlite-static musl-dev perl
+RUN curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --default-toolchain stable
+ENV PATH="/root/.cargo/bin:${PATH}"
+ENV RUSTFLAGS="-C target-cpu=native -C opt-level=z -C panic=abort -C codegen-units=1"
+ARG ARTI_VERSION=1.6.0
+RUN git clone --depth 1 --branch arti-v${ARTI_VERSION} https://gitlab.torproject.org/tpo/core/arti.git /src/arti
+WORKDIR /src/arti
+RUN cargo fetch
+RUN cargo build --release --bin arti --features=static
+RUN strip /src/arti/target/release/arti
+
+FROM alpine:3.22 AS runtime
+RUN apk add --no-cache ca-certificates libgcc sqlite-libs && \
+    adduser -D -s /bin/sh toruser
+COPY --from=builder /src/arti/target/release/arti /usr/local/bin/arti
+COPY config.toml /config/config.toml
+RUN chown -R toruser:toruser /config
+USER toruser
+EXPOSE 9050 5353
+HEALTHCHECK --interval=30s --timeout=10s --start-period=60s --retries=3 CMD nc -z localhost 9050 || exit 1
+ENTRYPOINT ["/usr/local/bin/arti", "proxy", "-c", "/config/config.toml"]
\ No newline at end of file

From 7a6f865b086b42365a6870a816804df4336ffb5f Mon Sep 17 00:00:00 2001
From: josh! <github@joshhighet.com>
Date: Wed, 8 Oct 2025 16:15:06 +1300
Subject: [PATCH 2/2] no allow_running_as_root

---
 config.toml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/config.toml b/config.toml
index e47467c..4633a10 100644
--- a/config.toml
+++ b/config.toml
@@ -2,7 +2,7 @@
 socks_listen = "0.0.0.0:9050"
 
 [application]
-allow_running_as_root = true
+allow_running_as_root = false
 
 [bridge]
 enabled = false