[{"_1":2,"_187":-5,"_188":-5},"loaderData",{"_3":4,"_17":18,"_25":26,"_159":160},"root",{"_5":-5,"_6":-7,"_7":8,"_9":-7,"_10":11,"_12":-7,"_13":14,"_15":16},"currentUser","primaryEmail","siteVerification","6LeIxAcTAAAAAJcZVRqyHh71UMIEGNQ_MXjiZKhI","toast","enableDev",false,"incidentStatus","theme","system","contrast","normal","routes/_layout",{"_19":-5,"_20":21,"_22":21,"_23":11,"_24":21},"username","isAskGordonEnabled",true,"isUsingNewTemplate","showMinimalLanding","showHoneypotTrap","routes/_layout.r.$namespace.$reponame",{"_27":28,"_29":-5,"_30":11,"_31":11,"_32":33,"_34":35,"_36":-5,"_37":11,"_38":39,"_92":-5,"_93":94,"_148":-5,"_149":11,"_150":21,"_151":11,"_152":-5,"_153":11,"_154":-5,"_155":156,"_157":95,"_158":-7},"canonicalUrl","https://hub.docker.com/r/showfom/dante/tags","mcpServer","canSeeDockerfile","canSeeAutobuilds","namespace","showfom","reponame","dante","cloudBuildSource","isAutobuildsAvailable","repo",{"_40":41,"_47":48,"_50":51,"_52":53,"_54":11,"_55":56,"_57":58,"_59":60,"_43":35,"_32":33,"_62":63,"_64":-5,"_65":66,"_67":68,"_69":70,"_71":-5,"_72":66,"_73":74,"_75":11,"_76":33,"_77":78,"_83":11,"_84":85,"_89":33,"_90":91},"categories",[42],{"_43":44,"_45":46},"name","Networking","slug","networking","content_types",[49],"image","date_registered","2026-09-14T11:14:42.149108Z","description","A Docker image for the Dante SOCKS5 server","is_private","last_updated","2026-09-14T13:27:17.201196Z","last_modified","2026-09-14T13:24:23.82442Z","media_types",[61],"application/vnd.oci.image.index.v1+json","pull_count",220,"repository_type","star_count",0,"status",1,"status_description","active","source","collaborator_count","full_description","# Dante SOCKS5 Proxy (Docker)\n\nA Docker image for the [Dante](https://www.inet.no/dante/) SOCKS5 server, built from source on `debian:trixie-slim`.\n\n## Background\n\nDebian Trixie doesn't ship a `dante-server` package, so there is no `apt install` route on current Debian. This repo builds Dante from the upstream source tarball and packages it as a Docker image instead.\n\n- Multi-stage build: compilers stay in the build stage, the runtime image only has `sockd` and `libpam0g`\n- The Dante version is a build argument, and the source tarball is checked against a SHA-256 checksum\n- Username/password auth by default; the login is created from environment variables when the container starts\n- An IP whitelist config is included for setups without a password\n\n## Images\n\nBuilt for linux/amd64 and linux/arm64 and published to both registries:\n\n| Registry | Image |\n| ---------- | --------------------------------------------------------------------------------- |\n| Docker Hub | [`showfom/dante:latest`](https://hub.docker.com/r/showfom/dante) |\n| GHCR | [`ghcr.io/showfom/dante:latest`](https://github.com/Showfom/dante/pkgs/container/dante) |\n\n## Quick start\n\n```bash\ngit clone git@github.com:showfom/dante.git\ncd dante\n# edit PROXY_USER and PROXY_PASSWORD in compose.yaml first\ndocker compose up -d\n```\n\nTo pull from GHCR instead of Docker Hub, change the image in `compose.yaml`:\n\n```yaml\nimage: ghcr.io/showfom/dante:latest\n```\n\nTest it:\n\n```bash\ncurl -x socks5h://proxy_user:change-me@YOUR_SERVER_IP:1080 https://ip.sb\n```\n\n## Files\n\n| File | Purpose |\n| ---------------------- | -------------------------------------------------------------- |\n| `Dockerfile` | Multi-stage build that compiles and packages `sockd` |\n| `docker-entrypoint.sh` | Creates or updates the proxy user from env vars at startup |\n| `.github/workflows/docker.yml` | Builds and pushes multi-arch images when a tag is pushed |\n| `compose.yaml` | Docker Compose setup using `showfom/dante:latest` |\n| `sockd.conf` | Default config (username/password), mounted read-only |\n| `sockd-whitelist.conf` | Alternative config: IP whitelist, no authentication |\n| `sockd.conf.example` | Upstream sample config (from the Debian package), fully commented |\n\n## Configuration\n\n### Environment variables\n\nSet these under `environment` in `compose.yaml`:\n\n| Variable | Description |\n| ---------------- | ------------------------------------------------------------ |\n| `PROXY_USER` | Proxy login name. Created inside the container at startup. |\n| `PROXY_PASSWORD` | Password for `PROXY_USER`. Reset on every container start. |\n\nThese are runtime settings, not part of the image: the published image contains no proxy user. If either one is empty, no user is created. With the default `socksmethod: username`, nobody can then use the proxy.\n\nFor more than one user, add them in the running container:\n\n```bash\ndocker exec -it dante sh -c 'useradd -M -s /usr/sbin/nologin bob && passwd bob'\n```\n\nUsers added this way are lost when the container is recreated. To keep them, extend `docker-entrypoint.sh`.\n\n### Build arguments\n\nDefined at the top of the `Dockerfile`:\n\n| Argument | Default | Description |\n| ---------------- | ------------------------ | ------------------------------------ |\n| `DANTE_VERSION` | current Dante release | Dante release to build |\n| `DANTE_SHA256` | checksum of that release | SHA-256 of `dante-.tar.gz` |\n| `DEBIAN_VERSION` | `trixie-slim` | Debian base image tag |\n\nTo upgrade Dante, get the new tarball's checksum:\n\n```bash\ncurl -fsSL https://www.inet.no/dante/files/dante-.tar.gz | sha256sum\n```\n\nUpdate `DANTE_VERSION` and `DANTE_SHA256` in the `Dockerfile` and build it yourself. The build fails if the checksum doesn't match:\n\n```bash\ndocker build -t showfom/dante:latest .\n```\n\nWithout Compose:\n\n```bash\ndocker run -d --name dante --init -p 1080:1080 \\\n -e PROXY_USER=proxy_user -e PROXY_PASSWORD=change-me \\\n showfom/dante:latest\n```\n\n### Releasing images\n\n`.github/workflows/docker.yml` runs on every pushed tag. It builds linux/amd64 and linux/arm64 on native GitHub runners, then pushes multi-arch images to both Docker Hub and GHCR. A tag like `` or `v` produces the image tags `` and `latest`; pre-release tags such as `-rc1` don't move `latest`.\n\nOne-time setup: in the GitHub repo under Settings → Environments, create an environment named `Docker Hub` and add these secrets to it (the job runs in that environment):\n\n| Secret | Value |\n| -------------------- | ------------------------------------------------------ |\n| `DOCKERHUB_USERNAME` | Docker Hub username |\n| `DOCKERHUB_TOKEN` | Docker Hub access token with Read & Write permission |\n\nGHCR uses the built-in `GITHUB_TOKEN`, so it needs no secret. After the first push, the GHCR package is private by default; make it public under the package's settings if you want anonymous pulls.\n\nTo release, bump the version in the `Dockerfile` if needed, then:\n\n```bash\ngit tag -m \"Dante \" \ngit push origin \n```\n\n### sockd.conf\n\nCompose mounts `sockd.conf` read-only at `/etc/sockd.conf`, so config changes only need a restart, not a rebuild:\n\n```bash\ndocker compose restart\n```\n\nThe default config:\n\n- listens on `0.0.0.0:1080` and sends traffic out through `eth0`\n- requires username/password (`socksmethod: username`)\n- blocks connections to the container's own loopback (`127.0.0.0/8`)\n- allows TCP `connect` and UDP `udpassociate`\n\nTo limit which client IPs can connect, narrow the `client pass` rule:\n\n```\nclient pass {\n from: 192.0.2.0/24 to: 0.0.0.0/0\n log: error\n}\n```\n\n### IP whitelist instead of username/password\n\n`sockd-whitelist.conf` turns off authentication (`socksmethod: none`) and only accepts clients from listed IPs. Everyone else is dropped.\n\n1. Edit the `client pass` blocks in `sockd-whitelist.conf`, one block per IP or CIDR range:\n\n ```\n client pass {\n from: 192.0.2.2/32 to: 0.0.0.0/0\n log: error\n }\n ```\n\n2. Mount it instead of `sockd.conf` in `compose.yaml`. `PROXY_USER` / `PROXY_PASSWORD` can be removed:\n\n ```yaml\n volumes:\n - ./sockd-whitelist.conf:/etc/sockd.conf:ro\n ```\n\n3. Restart: `docker compose up -d`\n\nBefore relying on the whitelist, make sure the container sees real client IPs. Connect once from a non-listed IP and check `docker compose logs`: the blocked line must show the client's public IP. If it shows a Docker gateway address such as `172.17.0.1` instead, which happens with Docker's userland proxy and some IPv6 setups, use `network_mode: host` and remove the `ports:` section. Never whitelist Docker's internal ranges (`172.16.0.0/12`); that would effectively allow everyone.\n\nSee `sockd.conf.example` and the official docs for more: \n\n## Security notes\n\n- Don't expose port 1080 to the internet with `socksmethod: none`. Open proxies get found and abused quickly.\n- SOCKS5 username/password auth is sent in plain text. Use a strong password you don't use anywhere else, and restrict source IPs with a firewall or the `client pass` rule where you can.\n- `user.privileged: root` is required because Dante reads `/etc/shadow` to check passwords. Proxied traffic is handled as the unprivileged `sockd` user.\n\n## Logs\n\n```bash\ndocker compose logs -f\n```\n","has_starred","hub_user","immutable_tags_settings",{"_79":11,"_80":81},"enabled","rules",[82],".*","is_automated","permissions",{"_86":21,"_87":11,"_88":11},"read","write","admin","user","storage_size",61529906,"orgData","recentTags",[95,141],{"_96":49,"_97":98,"_99":100,"_101":102,"_103":104,"_105":106,"_55":129,"_130":98,"_131":33,"_132":61,"_43":133,"_134":135,"_136":137,"_138":129,"_139":70,"_140":21},"content_type","creator",1304126,"digest","sha256:4ace2041f031a8e9ad227c0ad10fea23dcbf2cd3e30e002e44faddc62292de92","full_size",30178548,"id",1307622780,"images",[107,123],{"_108":109,"_99":110,"_111":112,"_113":114,"_115":116,"_117":118,"_119":112,"_120":-5,"_121":102,"_67":70,"_122":-5},"architecture","amd64","sha256:5ee5f743e6d30776d94953e6ce59a2787dacae31a5333d2a1838e43fb78159dd","features","","last_pulled","2026-10-07T18:45:08.728494004Z","last_pushed","2026-09-14T13:22:55.565452429Z","os","linux","os_features","os_version","size","variant",{"_108":124,"_99":125,"_111":112,"_113":126,"_115":127,"_117":118,"_119":112,"_120":-5,"_121":128,"_67":70,"_122":-5},"arm64","sha256:d00c47b60577195e48fb2def9446c10aa92817b58844070a7483314f0462d0b2","2026-10-02T06:29:16.383970394Z","2026-09-14T13:22:53.542716194Z",30515292,"2026-09-14T13:23:49.018128Z","last_updater","last_updater_username","media_type","latest","repository",32463404,"tag_last_pulled","2026-10-08T13:00:37.271512028Z","tag_last_pushed","tag_status","v2",{"_96":49,"_97":98,"_99":100,"_101":102,"_103":142,"_105":143,"_55":146,"_130":98,"_131":33,"_132":61,"_43":147,"_134":135,"_136":137,"_138":146,"_139":70,"_140":21},1307622726,[144,145],{"_108":109,"_99":110,"_111":112,"_113":114,"_115":116,"_117":118,"_119":112,"_120":-5,"_121":102,"_67":70,"_122":-5},{"_108":124,"_99":125,"_111":112,"_113":126,"_115":127,"_117":118,"_119":112,"_120":-5,"_121":128,"_67":70,"_122":-5},"2026-09-14T13:23:47.518985Z","1.4.4","sbxKitMetadata","isPotentialSpam","isHubSbxKitsEnabled","showSbxLogoOverride","sbxTrademarkText","displaySecurityMetadata","tagAttestations","tagsHaveAttestations",[],"selectedTag","attestationsUrl","routes/_layout.r.$namespace.$reponame.tags",{"_38":161,"_169":170,"_155":185,"_186":11},{"_40":162,"_47":164,"_50":51,"_52":53,"_54":11,"_55":56,"_57":58,"_59":165,"_43":35,"_32":33,"_62":63,"_64":-5,"_65":66,"_67":68,"_69":70,"_71":-5,"_72":66,"_73":74,"_75":11,"_76":33,"_77":166,"_83":11,"_84":168,"_89":33,"_90":91},[163],{"_43":44,"_45":46},[49],[61],{"_79":11,"_80":167},[82],{"_86":21,"_87":11,"_88":11},"tags",{"_171":172,"_173":-5,"_174":-5,"_175":176},"count",2,"next","previous","results",[177,181],{"_96":49,"_97":98,"_99":100,"_101":102,"_103":104,"_105":178,"_55":129,"_130":98,"_131":33,"_132":61,"_43":133,"_134":135,"_136":137,"_138":129,"_139":70,"_140":21},[179,180],{"_108":109,"_99":110,"_111":112,"_113":114,"_115":116,"_117":118,"_119":112,"_120":-5,"_121":102,"_67":70,"_122":-5},{"_108":124,"_99":125,"_111":112,"_113":126,"_115":127,"_117":118,"_119":112,"_120":-5,"_121":128,"_67":70,"_122":-5},{"_96":49,"_97":98,"_99":100,"_101":102,"_103":142,"_105":182,"_55":146,"_130":98,"_131":33,"_132":61,"_43":147,"_134":135,"_136":137,"_138":146,"_139":70,"_140":21},[183,184],{"_108":109,"_99":110,"_111":112,"_113":114,"_115":116,"_117":118,"_119":112,"_120":-5,"_121":102,"_67":70,"_122":-5},{"_108":124,"_99":125,"_111":112,"_113":126,"_115":127,"_117":118,"_119":112,"_120":-5,"_121":128,"_67":70,"_122":-5},[],"canDeleteTags","actionData","errors"]

Digest	OS/ARCH	Compressed size
5ee5f743e6d3	linux/amd64	28.78 MB
d00c47b60577	linux/arm64	29.1 MB

showfom/dante

Tags for showfom/dante