Tor Browser in a Container

From NixOS Wiki
Jump to: navigation, search

Here are a few steps to run Tor Browser in NixOS Container w/ Pulse, Media Support. Most of the time, ssh -X would have sufficed. Nevertheless, to route audio, the following is required. There is, probably, an easier way; but I am not aware of it.

Need a few programs beforehand. Install the followings in your user profile.

nix-env -iA nixos.socat

Use the following container conf in configuration.nix or derive your own.

  containers.browser = {
    autoStart = false;
    privateNetwork = true;
    hostAddress = "";
    localAddress = "";
    config = {config, pkgs, ... }: {
      services.openssh = {
        enable = true;
        forwardX11 = true;

      users.extraUsers.browser = {
        isNormalUser = true;
        home = "/home/browser";
        openssh.authorizedKeys.keys = [ SSH-KEYS-GO-HERE ];
        extraGroups = ["audio" "video"];

Mind to fill the SSH keys in. Need to open up ports and pulse audio also:

  networking.firewall.allowedTCPPorts = [ 4713 6000 ];
  hardware.pulseaudio = {
    enable = true;
    systemWide = true;
    support32Bit = true;
    tcp = { enable = true; anonymousClients = { allowedIpRanges = ["" ""]; }; };

Also, configuring NAT is necessary:

  networking.nat.enable = true;
  networking.nat.internalInterfaces = ["ve-browser"];
  networking.nat.externalInterface = "YOUR-EXTERNAL-INTERFACE";

Then, follow the steps:

  1. Do a usual nixos-rebuild switch and container will be created.
  2. Run the container nixos-container start browser.
  3. Root login nixos-container root-login browser
  4. Update nix-channel --update
  5. Switch nixos-rebuild switch

Now the container should be in a sane state to work on. Install the browser and apulse:

[root@browser:~]$ su - browser
[browser@browser:~]$ nix repl
Welcome to Nix version 2.2. Type :? for help.

nix-repl> pkgs = import <nixpkgs> {}                                                                                                                    
nix-repl> :i pkgs.callPackage <nixpkgs/pkgs/applications/networking/browsers/tor-browser-bundle-bin> { mediaSupport = true; pulseaudioSupport = true; }
installing 'tor-browser-bundle-bin-8.0.6.drv'
nix-repl> :i pkgs.callPackage <nixpkgs/pkgs/misc/apulse> {} 
installing 'apulse-'
these paths will be fetched (0.04 MiB download, 0.20 MiB unpacked):
copying path '/nix/store/mi6kyfjymb3bdpwic3hy9y64hv21hflc-apulse-' from ''...
building '/nix/store/r00d47r40v7mhblly9rqas434x2d53js-user-environment.drv'...
created 121 symlinks in user environment

The following two scripts are needed. Put them in ~/bin or any other directory included in the path.

This is executed by the host.

socat -d TCP-LISTEN:6000,fork,bind= UNIX-CONNECT:/tmp/.X11-unix/X0 &
xhost +
ssh -X browser@

This is executed in the container (guest) by the previous one executed on the host.

PULSE_SERVER=tcp: XAUTHORITY="/home/browser/.Xauthority" DBUS_SESSION_BUS_ADDRESS="" DISPLAY= apulse tor-browser $@

That's it.

Now you should be able to run the browser in a container and have media and audio support.

Have a nice day.