Isn't all this reserved to TCP, in other words in which way may it protect non-TCP activity?
Instructions on front page for install don't work. Need to change the version number from 0.4.0 to 0.5.0
cargo install --git https://gitlab.torproject.org/tpo/core/oniux oniux@0.5.0Oniux seems like an "officially" supported tool similar to orjail (which hasn't received a commit in four years, but still works great as a shell script with iptables/iproute tools [1]). Orjail has also an option to run with firejail for further isolation, which seems to be still a feature that Oniux doesn't have.
[1] https://github.com/orjail/orjail/blob/master/usr/sbin/orjail
Hmm. I assumed this worked like torsocks in that it would direct traffic through the locally running tor daemon. However, I've noticed that if I stop the locally running tor daemon, oniux still works whilst torify and torsocks do not. [edit] The documentation does actually say this. Pretty neat.
It works inside docker as well, but I needed to use --privileged. Just copied the binary into a debian:12 container and it works there:
docker run -it --rm --privileged -v "$PWD/oniux:/usr/bin/oniux" debian:12Fun fact, this has been broken with curl for 5 years (and so are the blog examples), because Tor developers previously insisted that apps shouldn't attempt to resolve .onion domain names: https://daniel.haxx.se/blog/2025/05/16/leeks-and-leaks/
I hope they can find a resolution.
Does this mean one can now access tor websites using chrome?
They use hexchat as an example but do these processes run with the users configuration? Wouldn't this leak IRC usernames if you forget to change it. ... Or leak cookies if you launch a browser?
The DevEx is beautifully done here i.e it’s idiot-proof! Nice work to the people behind this <3
Nice, now please rewrite the prototype in C and will happily use it.
Huh. I had a conversation with a Tor developer on this topic about a decade ago, when network namespaces were still kind of a new hotness - the feedback I got was that it would be an easy way for people to think they were being secure while still leaking a bunch of identifiable information, so I didn't push that any further.