[{"_1":2,"_178":-5,"_179":-5},"loaderData",{"_3":4,"_13":14,"_20":21,"_150":151},"root",{"_5":-5,"_6":-7,"_7":8,"_9":-7,"_10":11,"_12":-7},"currentUser","primaryEmail","siteVerification","6LeIxAcTAAAAAJcZVRqyHh71UMIEGNQ_MXjiZKhI","toast","enableDev",false,"incidentStatus","routes/_layout",{"_15":-5,"_16":17,"_18":17,"_19":11},"username","isAskGordonEnabled",true,"isUsingNewTemplate","showMinimalLanding","routes/_layout.r.$namespace.$reponame",{"_22":23,"_24":-5,"_25":11,"_26":11,"_27":28,"_29":30,"_31":-5,"_32":11,"_33":34,"_87":-5,"_88":89,"_143":-5,"_144":11,"_145":17,"_146":11,"_147":-5,"_148":149},"canonicalUrl","https://hub.docker.com/r/showfom/dante/tags","mcpServer","canSeeDockerfile","canSeeAutobuilds","namespace","showfom","reponame","dante","cloudBuildSource","isAutobuildsAvailable","repo",{"_35":36,"_42":43,"_45":46,"_47":48,"_49":11,"_50":51,"_52":53,"_54":55,"_38":30,"_27":28,"_57":58,"_59":-5,"_60":61,"_62":63,"_64":65,"_66":-5,"_67":61,"_68":69,"_70":11,"_71":28,"_72":73,"_78":11,"_79":80,"_84":28,"_85":86},"categories",[37],{"_38":39,"_40":41},"name","Networking","slug","networking","content_types",[44],"image","date_registered","2026-09-14T11:14:42.149108Z","description","A Docker image for the Dante SOCKS5 server","is_private","last_updated","2026-09-14T13:27:17.201196Z","last_modified","2026-09-14T13:24:23.82442Z","media_types",[56],"application/vnd.oci.image.index.v1+json","pull_count",138,"repository_type","star_count",0,"status",1,"status_description","active","source","collaborator_count","full_description","# Dante SOCKS5 Proxy (Docker)\n\nA Docker image for the [Dante](https://www.inet.no/dante/) SOCKS5 server, built from source on `debian:trixie-slim`.\n\n## Background\n\nDebian Trixie doesn't ship a `dante-server` package, so there is no `apt install` route on current Debian. This repo builds Dante from the upstream source tarball and packages it as a Docker image instead.\n\n- Multi-stage build: compilers stay in the build stage, the runtime image only has `sockd` and `libpam0g`\n- The Dante version is a build argument, and the source tarball is checked against a SHA-256 checksum\n- Username/password auth by default; the login is created from environment variables when the container starts\n- An IP whitelist config is included for setups without a password\n\n## Images\n\nBuilt for linux/amd64 and linux/arm64 and published to both registries:\n\n| Registry | Image |\n| ---------- | --------------------------------------------------------------------------------- |\n| Docker Hub | [`showfom/dante:latest`](https://hub.docker.com/r/showfom/dante) |\n| GHCR | [`ghcr.io/showfom/dante:latest`](https://github.com/Showfom/dante/pkgs/container/dante) |\n\n## Quick start\n\n```bash\ngit clone git@github.com:showfom/dante.git\ncd dante\n# edit PROXY_USER and PROXY_PASSWORD in compose.yaml first\ndocker compose up -d\n```\n\nTo pull from GHCR instead of Docker Hub, change the image in `compose.yaml`:\n\n```yaml\nimage: ghcr.io/showfom/dante:latest\n```\n\nTest it:\n\n```bash\ncurl -x socks5h://proxy_user:change-me@YOUR_SERVER_IP:1080 https://ip.sb\n```\n\n## Files\n\n| File | Purpose |\n| ---------------------- | -------------------------------------------------------------- |\n| `Dockerfile` | Multi-stage build that compiles and packages `sockd` |\n| `docker-entrypoint.sh` | Creates or updates the proxy user from env vars at startup |\n| `.github/workflows/docker.yml` | Builds and pushes multi-arch images when a tag is pushed |\n| `compose.yaml` | Docker Compose setup using `showfom/dante:latest` |\n| `sockd.conf` | Default config (username/password), mounted read-only |\n| `sockd-whitelist.conf` | Alternative config: IP whitelist, no authentication |\n| `sockd.conf.example` | Upstream sample config (from the Debian package), fully commented |\n\n## Configuration\n\n### Environment variables\n\nSet these under `environment` in `compose.yaml`:\n\n| Variable | Description |\n| ---------------- | ------------------------------------------------------------ |\n| `PROXY_USER` | Proxy login name. Created inside the container at startup. |\n| `PROXY_PASSWORD` | Password for `PROXY_USER`. Reset on every container start. |\n\nThese are runtime settings, not part of the image: the published image contains no proxy user. If either one is empty, no user is created. With the default `socksmethod: username`, nobody can then use the proxy.\n\nFor more than one user, add them in the running container:\n\n```bash\ndocker exec -it dante sh -c 'useradd -M -s /usr/sbin/nologin bob && passwd bob'\n```\n\nUsers added this way are lost when the container is recreated. To keep them, extend `docker-entrypoint.sh`.\n\n### Build arguments\n\nDefined at the top of the `Dockerfile`:\n\n| Argument | Default | Description |\n| ---------------- | ------------------------ | ------------------------------------ |\n| `DANTE_VERSION` | current Dante release | Dante release to build |\n| `DANTE_SHA256` | checksum of that release | SHA-256 of `dante-.tar.gz` |\n| `DEBIAN_VERSION` | `trixie-slim` | Debian base image tag |\n\nTo upgrade Dante, get the new tarball's checksum:\n\n```bash\ncurl -fsSL https://www.inet.no/dante/files/dante-.tar.gz | sha256sum\n```\n\nUpdate `DANTE_VERSION` and `DANTE_SHA256` in the `Dockerfile` and build it yourself. The build fails if the checksum doesn't match:\n\n```bash\ndocker build -t showfom/dante:latest .\n```\n\nWithout Compose:\n\n```bash\ndocker run -d --name dante --init -p 1080:1080 \\\n -e PROXY_USER=proxy_user -e PROXY_PASSWORD=change-me \\\n showfom/dante:latest\n```\n\n### Releasing images\n\n`.github/workflows/docker.yml` runs on every pushed tag. It builds linux/amd64 and linux/arm64 on native GitHub runners, then pushes multi-arch images to both Docker Hub and GHCR. A tag like `` or `v` produces the image tags `` and `latest`; pre-release tags such as `-rc1` don't move `latest`.\n\nOne-time setup: in the GitHub repo under Settings → Environments, create an environment named `Docker Hub` and add these secrets to it (the job runs in that environment):\n\n| Secret | Value |\n| -------------------- | ------------------------------------------------------ |\n| `DOCKERHUB_USERNAME` | Docker Hub username |\n| `DOCKERHUB_TOKEN` | Docker Hub access token with Read & Write permission |\n\nGHCR uses the built-in `GITHUB_TOKEN`, so it needs no secret. After the first push, the GHCR package is private by default; make it public under the package's settings if you want anonymous pulls.\n\nTo release, bump the version in the `Dockerfile` if needed, then:\n\n```bash\ngit tag -m \"Dante \" \ngit push origin \n```\n\n### sockd.conf\n\nCompose mounts `sockd.conf` read-only at `/etc/sockd.conf`, so config changes only need a restart, not a rebuild:\n\n```bash\ndocker compose restart\n```\n\nThe default config:\n\n- listens on `0.0.0.0:1080` and sends traffic out through `eth0`\n- requires username/password (`socksmethod: username`)\n- blocks connections to the container's own loopback (`127.0.0.0/8`)\n- allows TCP `connect` and UDP `udpassociate`\n\nTo limit which client IPs can connect, narrow the `client pass` rule:\n\n```\nclient pass {\n from: 192.0.2.0/24 to: 0.0.0.0/0\n log: error\n}\n```\n\n### IP whitelist instead of username/password\n\n`sockd-whitelist.conf` turns off authentication (`socksmethod: none`) and only accepts clients from listed IPs. Everyone else is dropped.\n\n1. Edit the `client pass` blocks in `sockd-whitelist.conf`, one block per IP or CIDR range:\n\n ```\n client pass {\n from: 192.0.2.2/32 to: 0.0.0.0/0\n log: error\n }\n ```\n\n2. Mount it instead of `sockd.conf` in `compose.yaml`. `PROXY_USER` / `PROXY_PASSWORD` can be removed:\n\n ```yaml\n volumes:\n - ./sockd-whitelist.conf:/etc/sockd.conf:ro\n ```\n\n3. Restart: `docker compose up -d`\n\nBefore relying on the whitelist, make sure the container sees real client IPs. Connect once from a non-listed IP and check `docker compose logs`: the blocked line must show the client's public IP. If it shows a Docker gateway address such as `172.17.0.1` instead, which happens with Docker's userland proxy and some IPv6 setups, use `network_mode: host` and remove the `ports:` section. Never whitelist Docker's internal ranges (`172.16.0.0/12`); that would effectively allow everyone.\n\nSee `sockd.conf.example` and the official docs for more: \n\n## Security notes\n\n- Don't expose port 1080 to the internet with `socksmethod: none`. Open proxies get found and abused quickly.\n- SOCKS5 username/password auth is sent in plain text. Use a strong password you don't use anywhere else, and restrict source IPs with a firewall or the `client pass` rule where you can.\n- `user.privileged: root` is required because Dante reads `/etc/shadow` to check passwords. Proxied traffic is handled as the unprivileged `sockd` user.\n\n## Logs\n\n```bash\ndocker compose logs -f\n```\n","has_starred","hub_user","immutable_tags_settings",{"_74":11,"_75":76},"enabled","rules",[77],".*","is_automated","permissions",{"_81":17,"_82":11,"_83":11},"read","write","admin","user","storage_size",61529906,"orgData","recentTags",[90,136],{"_91":44,"_92":93,"_94":95,"_96":97,"_98":99,"_100":101,"_50":124,"_125":93,"_126":28,"_127":56,"_38":128,"_129":130,"_131":132,"_133":124,"_134":65,"_135":17},"content_type","creator",1304126,"digest","sha256:4ace2041f031a8e9ad227c0ad10fea23dcbf2cd3e30e002e44faddc62292de92","full_size",30178548,"id",1307622780,"images",[102,118],{"_103":104,"_94":105,"_106":107,"_108":109,"_110":111,"_112":113,"_114":107,"_115":-5,"_116":97,"_62":65,"_117":-5},"architecture","amd64","sha256:5ee5f743e6d30776d94953e6ce59a2787dacae31a5333d2a1838e43fb78159dd","features","","last_pulled","2026-09-16T05:47:03.376375851Z","last_pushed","2026-09-14T13:22:55.565452429Z","os","linux","os_features","os_version","size","variant",{"_103":119,"_94":120,"_106":107,"_108":121,"_110":122,"_112":113,"_114":107,"_115":-5,"_116":123,"_62":65,"_117":-5},"arm64","sha256:d00c47b60577195e48fb2def9446c10aa92817b58844070a7483314f0462d0b2","2026-09-15T15:08:59.785247515Z","2026-09-14T13:22:53.542716194Z",30515292,"2026-09-14T13:23:49.018128Z","last_updater","last_updater_username","media_type","latest","repository",32463404,"tag_last_pulled","2026-09-16T13:00:18.380211058Z","tag_last_pushed","tag_status","v2",{"_91":44,"_92":93,"_94":95,"_96":97,"_98":137,"_100":138,"_50":141,"_125":93,"_126":28,"_127":56,"_38":142,"_129":130,"_131":132,"_133":141,"_134":65,"_135":17},1307622726,[139,140],{"_103":104,"_94":105,"_106":107,"_108":109,"_110":111,"_112":113,"_114":107,"_115":-5,"_116":97,"_62":65,"_117":-5},{"_103":119,"_94":120,"_106":107,"_108":121,"_110":122,"_112":113,"_114":107,"_115":-5,"_116":123,"_62":65,"_117":-5},"2026-09-14T13:23:47.518985Z","1.4.4","sbxKitMetadata","isPotentialSpam","isHubSbxKitsEnabled","displaySecurityMetadata","tagAttestations","tagsHaveAttestations",[],"routes/_layout.r.$namespace.$reponame.tags",{"_33":152,"_160":161,"_148":176,"_177":11},{"_35":153,"_42":155,"_45":46,"_47":48,"_49":11,"_50":51,"_52":53,"_54":156,"_38":30,"_27":28,"_57":58,"_59":-5,"_60":61,"_62":63,"_64":65,"_66":-5,"_67":61,"_68":69,"_70":11,"_71":28,"_72":157,"_78":11,"_79":159,"_84":28,"_85":86},[154],{"_38":39,"_40":41},[44],[56],{"_74":11,"_75":158},[77],{"_81":17,"_82":11,"_83":11},"tags",{"_162":163,"_164":-5,"_165":-5,"_166":167},"count",2,"next","previous","results",[168,172],{"_91":44,"_92":93,"_94":95,"_96":97,"_98":99,"_100":169,"_50":124,"_125":93,"_126":28,"_127":56,"_38":128,"_129":130,"_131":132,"_133":124,"_134":65,"_135":17},[170,171],{"_103":104,"_94":105,"_106":107,"_108":109,"_110":111,"_112":113,"_114":107,"_115":-5,"_116":97,"_62":65,"_117":-5},{"_103":119,"_94":120,"_106":107,"_108":121,"_110":122,"_112":113,"_114":107,"_115":-5,"_116":123,"_62":65,"_117":-5},{"_91":44,"_92":93,"_94":95,"_96":97,"_98":137,"_100":173,"_50":141,"_125":93,"_126":28,"_127":56,"_38":142,"_129":130,"_131":132,"_133":141,"_134":65,"_135":17},[174,175],{"_103":104,"_94":105,"_106":107,"_108":109,"_110":111,"_112":113,"_114":107,"_115":-5,"_116":97,"_62":65,"_117":-5},{"_103":119,"_94":120,"_106":107,"_108":121,"_110":122,"_112":113,"_114":107,"_115":-5,"_116":123,"_62":65,"_117":-5},[],"canDeleteTags","actionData","errors"]

Digest	OS/ARCH	Compressed size
5ee5f743e6d3	linux/amd64	28.78 MB
d00c47b60577	linux/arm64	29.1 MB

showfom/dante

Tags for showfom/dante