FAQ

What is HiddenForge, in one sentence? A hardened container that turns a web app you already run into a Tor .onion service, without exposing the server.

Do I need to know Tor to use it? No. Point it at your app with one environment variable and it handles the Tor side. To trust it, read How It Works and The Security Model.

Docker or Podman? Both. There's a compose file for each. Rootless Podman needs slightly different capabilities, which the Podman compose file already sets.

How long until my address is live? A few minutes on first boot. Tor has to bootstrap fully and publish the service. The container reports "healthy" only when it's genuinely reachable, so wait for that.

Can I choose my .onion address? Yes, optionally. Generate a v3 key (including vanity prefixes with a tool like mkp224o) offline and mount it before first start. See Backing Up Your Onion Address.

Will upgrading change my address? No, as long as you keep your key folder. Upgrades never touch existing keys. See Upgrading Safely.

Can I run more than one site? Yes. Each *_TOR_SERVICE_HOSTS variable is its own independent .onion. See Running Multiple Services.

Can I use this to browse anonymously? No. It publishes a service; it is not a client proxy. The SOCKS proxy is deliberately off.

Is my server's IP hidden from visitors? Yes, that's the core purpose. Visitors reach you through Tor's rendezvous mechanism and never learn your server's address. But this only holds if you don't undo it; see OPSEC: Mistakes That Deanonymize You.

Does it make my service a Tor relay? No. It's configured to never relay or exit other people's traffic.

Why is Docker's seccomp turned off (seccomp=unconfined)? So it doesn't collide with Tor's own, stronger sandbox, which does the syscall filtering. This is a deliberate choice, not a loosening. See The Security Model.

What if Vanguards doesn't start? Your service still works on Tor's built-in vanguards-lite protection. It's degraded, not down. Check the logs to see why it didn't come up.

Is this good enough for a high-risk, long-lived service? It's a strong default, but there's an honest limit around deep guard protection for long-lived services. Read the "limits" section of The Security Model before betting something serious on it.

How do I know the image is really yours and not tampered with? Verify the signatures (three independent ones) and, if you want, reproduce the build yourself. See Verifying the Image.

Where does it get published? The maintainer's own registry at sambent.dev/sam/hiddenforge, mirrored on Docker Hub at doingfedtime/hiddenforge.

Something's broken. Where do I start? The logs: docker compose logs tor. Then Troubleshooting.