A private Tor network

This starter runs seven containers on one private Docker network. The running network has no Internet route and trusts only its own authority. Building the image needs Internet access to download software. The instructions and questions are on Canvas. You do not need to write code. Use only the supplied lab target, not real sites or the public Tor network.

Files

• compose.yaml defines the containers and the internal network. No ports are published to your computer.
• Dockerfile installs Tor, curl, tcpdump and Python in an Alpine Linux image.
• torrc/ contains the Tor configuration for each role.
• da-keys/ contains shared, disposable credentials for this test authority. They are not production secrets and must never be used outside this lab.
• bin/request fetches the lab page and reports the circuit that actually carried its stream. It uses Python's standard library and Tor's control interface.
• bin/circuits lists available web-capable circuits, including spare ones. It does not identify the circuit used by a request.
• bin/newcircuits sends NEWNYM. It separates new requests from old dirty circuits, but does not promise a different path.
• web/ contains the target page.
• example-output.txt provides recorded lab output if you cannot run Docker. It is evidence to interpret, not an answer key.

Address map

Service	Address	Role
da	10.77.0.10	Directory authority and non-exit relay
relay1	10.77.0.11	Non-exit relay
relay2	10.77.0.12	Non-exit relay
relay3	10.77.0.14	Non-exit relay
exit	10.77.0.13	The only HTTP exit; Tor calls it exit1
web	10.77.0.80	HTTP target
client	10.77.0.100	Tor client

Build and run

Run commands from this folder. The image uses a multi-architecture Alpine base. You will need to allow Docker enough memory for seven containers, up to 256 MiB each.

docker compose up -d --build
docker compose logs --tail=10 client
docker compose exec client request tor-lab-01
docker compose down

Look for Bootstrapped 100% (done) before a request. If it fails, inspect docker compose logs --tail=20 client da. A first image download can take longer than the Tor startup itself. Stopping the lab removes its temporary Tor state; starting it again selects new relay identities and guards. The Docker image remains cached.

References

The commands use Compose exec, curl's SOCKS proxy option, tcpdump, Tor STREAM events, and NEWNYM. The measurement questions and assigned specification sections are on Canvas.