Your Own SOCKS5 Proxy in 60 Seconds: Deploying Dante in Docker the Right Way

Every developer at some point needs to route traffic through a specific server. Maybe you want to test geo-restricted APIs, bypass corporate firewalls, or just stop trusting random free proxies that probably harvest your credentials. The usual solution is a VPN — which is massive overkill if all you need is a lightweight, fast tunnel for a single app or curl request.

The sane answer is a SOCKS5 proxy. And the best open-source SOCKS5 server in existence is Dante — written in C, maintained since 1997, battle-tested on production infrastructure worldwide.

The problem: setting up Dante manually is annoying. You compile it, write a config, create a system user, handle PAM authentication, and pray you didn’t fat-finger an interface name. I got tired of doing that on every new VPS.

So I built dante-proxy — a Docker image that does all of that for you automatically.

Why Dante and Not Something Else?

There are a dozen SOCKS5 implementations floating around. Most are abandoned, under-maintained, or riddled with old CVEs. The popular adegtyarev/docker-dante image, which this project was inspired by, shipped Dante 1.4.2 from 2019 and hadn’t been touched since.

Dante 1.4.4 patches CVE-2024–54662 — a real vulnerability affecting versions 1.4.0 through 1.4.3. If you’re running the old popular image, you’re exposed.

Beyond security: Dante is simply the right tool. It’s lean, fast, and supports proper username/password authentication over PAM — which means your proxy isn’t a free relay for anyone who finds the port.

What dante-proxy Does Differently

Most Docker proxy images require you to hand-write a config, create users manually, or expose credentials in environment variables from day one. This one takes a different approach:

• Auto-detects your network interface — no need to know whether it’s eth0, ens3, or enp0s3
• Generates a strong 24-character password on first start — just run it and read the logs
• Runs as nobody — zero root processes at runtime
• Drops all Linux capabilities except the two needed for su/chpasswd
• Multi-stage build — the final image contains zero compiler toolchain, just the binary

Let’s set it up.

Step 1: Open the Port

Before anything else, tell your firewall to let SOCKS5 traffic through. SOCKS5 runs over TCP only — no UDP rule needed.

sudo ufw allow 1080/tcp

Cloud servers — this alone is not enough. Every major cloud provider has a separate network-level firewall on top of the OS firewall. You need to open the port there too.

Oracle Cloud (OCI): OCI Console → Networking → Virtual Cloud Networks → your VCN → Security Lists → Default Security List → Add Ingress Rules → TCP, port 1080, source 0.0.0.0/0.

AWS (EC2): EC2 → Security Groups → your group → Inbound rules → Add rule → Custom TCP, port 1080, source 0.0.0.0/0.

Get Mike_i’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

Hetzner: Firewall → Inbound rules → Add rule → TCP, port 1080.

Step 2: Clone and Run

git clone https://github.com/banfen321/dante-proxy.git
cd dante-proxy
docker compose up -d

That’s it. No config files to edit before the first run.

Step 3: Get Your Credentials

docker compose logs dante

You’ll see something like this:

============================================
 Dante SOCKS5 Proxy
--------------------------------------------
 Interface : ens3
 Port      : 1080
 User      : proxy
 Password  : kR7mXvB2nQpLsY4dAcJe9wGu

 NOTE: Password was auto-generated.
       Set SOCKD_USER_PASSWORD in .env
       to keep it across restarts.
===========================================

The auto-detected interface, port, username, and generated password — all in one place. Connect immediately.

Step 4: Test It

curl --socks5-hostname proxy:kR7mXvB2nQpLsY4dAcJe9wGu@<YOUR_SERVER_IP>:1080 https://ifconfig.me

If the returned IP matches your server — you’re done.

Pinning Your Credentials (Recommended)

The auto-generated password changes on every container restart unless you pin it. Create a .env file:

cp .env.example .env

Edit it:

SOCKD_PORT=1080
SOCKD_USER_NAME=proxy
SOCKD_USER_PASSWORD=your-strong-password-here
SOCKD_EXTERNAL_IFACE=

Restart the container:

docker compose up -d

From this point, credentials survive restarts and image updates.

Using the Proxy

One-off command:

curl --socks5-hostname user:password@<HOST>:1080 https://ifconfig.me

Session-wide in your terminal:

export ALL_PROXY=socks5h://user:password@<HOST>:1080

Firefox: Settings → Network Settings → Manual proxy configuration → SOCKS Host: <HOST>, Port: 1080, SOCKS5. Check Proxy DNS when using SOCKS v5 — this routes DNS queries through the proxy too, which is what you actually want for privacy.

Gotchas

network_mode: host is not a mistake. Dante needs to see the real source IPs of connecting clients for correct routing and logging. Bridge networking on cloud servers causes routing asymmetry — Dante can bind but can’t route return traffic correctly. Host networking sidesteps this cleanly.

The password resets on restart if you don’t set it. This is intentional — the container is safe out of the box without requiring any manual setup. But read the logs after docker compose up -d and save the credentials immediately, or just set SOCKD_USER_PASSWORD in .env before the first run.

Oracle Cloud’s default VCN has stateful security lists — the ingress rule is enough, you don’t need a matching egress rule. Stateful tracking handles the return traffic automatically.

Updating

docker compose pull
docker compose up -d

The image is built automatically via GitHub Actions on every push. Latest Dante, latest Alpine, latest CVE patches.

The Full Security Stack

To be transparent about what’s hardened inside the container:

cap_drop:
  - ALL
cap_add:
  - SETUID    # needed for chpasswd at startup
  - SETGID
security_opt:
  - no-new-privileges:true

• Base: Alpine 3.21 (minimal attack surface)
• Dante: 1.4.4, compiled from source with SHA256 checksum verification
• Multi-stage build — compiler, headers, and build tools never touch the final image
• All processes exec as nobody after startup
• Anonymous access: disabled. Password auth required for every connection.

Wrapping Up

If you need a fast, private, authenticated SOCKS5 exit point on a VPS you control — this is the cleanest way to do it. One docker compose up -d, read the logs, connect. No VPN overhead, no monthly subscription, no trusting a third party with your traffic.

Clone it, run it, own your traffic: github.com/banfen321/dante-proxy

​