diff --git a/configs/tor/Containerfile b/configs/tor/Containerfile
index b4ef558..f8531ab 100644
--- a/configs/tor/Containerfile
+++ b/configs/tor/Containerfile
@@ -1,10 +1,18 @@
+# koopa-tor-relay — Tor non-exit relay
+# Process is NOT root: debian-tor remapped to uid/gid 1000 for rootless
+# podman + host volumes (~/koopa-tor-relay/{data,log} owned by hernani).
+# Recreate container with: --user 1000:1000 --userns=keep-id  (see README).
 FROM docker.io/library/debian:bookworm-slim
 ENV DEBIAN_FRONTEND=noninteractive
 RUN apt-get update \
  && apt-get install -y --no-install-recommends tor nyx ca-certificates tor-geoipdb \
  && rm -rf /var/lib/apt/lists/* \
  && mkdir -p /var/lib/tor /var/log/tor \
- && chown -R debian-tor:debian-tor /var/lib/tor /var/log/tor
+ && groupmod --gid 1000 debian-tor \
+ && usermod --uid 1000 --gid 1000 debian-tor \
+ && chown -R debian-tor:debian-tor /var/lib/tor /var/log/tor \
+ && chmod 700 /var/lib/tor
 EXPOSE 8080 9051
+USER debian-tor:debian-tor
 ENTRYPOINT ["/usr/bin/tor"]
 CMD ["-f", "/etc/tor/torrc", "--runasdaemon", "0"]
diff --git a/configs/tor/README.md b/configs/tor/README.md
index cd14262..cb7d980 100644
--- a/configs/tor/README.md
+++ b/configs/tor/README.md
@@ -15,13 +15,16 @@ Mirror in this repo: `configs/tor/`.
 | MyFamily | `52BB94DDC1292F950CF728708AC48523E018A718` |
 | Bandwidth* | 2000 MBytes rate/burst |
 | Image | `localhost/koopa-tor-relay:latest` (Debian bookworm + tor + nyx) |
+| Process user | **non-root** `debian-tor` remapped to **uid/gid 1000** (`USER` in image) |
+| Rootless note | recreate with `--user 1000:1000 --userns=keep-id` so `~/koopa-tor-relay/data` (hernani) stays writable |
 
 ## Files
 
 | File | Role |
 |------|------|
 | `torrc` | Active policy (mounted read-only into container) |
-| `Containerfile` | Image build (tor, nyx, tor-geoipdb) |
+| `Containerfile` | Image build (tor, nyx, tor-geoipdb); **not** root process |
+| `create-container.sh` | Recreate container non-root + host net + volume mounts |
 | `migrate-identity.sh` | One-shot copy of `/var/lib/tor` → container data (same identity) |
 | `container-koopa-tor-relay.service` | systemd --user unit template |
 | `torrc.minimal` / `torrc.sample` | Distro templates (reference) |
@@ -29,8 +32,16 @@ Mirror in this repo: `configs/tor/`.
 ## Ops
 
 ```bash
+# build image + recreate non-root container (as hernani)
+cd ~/koopa-tor-relay/build   # or configs/tor mirror
+podman build -t localhost/koopa-tor-relay:latest -f Containerfile .
+./create-container.sh        # or: bash configs/tor/create-container.sh
+podman start koopa-tor-relay
+systemctl --user enable --now container-koopa-tor-relay.service
+
 # status
 podman ps --filter name=koopa-tor-relay
+podman exec koopa-tor-relay id   # expect uid=1000(debian-tor)
 systemctl --user status container-koopa-tor-relay
 ss -lntp | grep -E '8080|9051'
 tail -f ~/koopa-tor-relay/log/notices.log
diff --git a/configs/tor/create-container.sh b/configs/tor/create-container.sh
new file mode 100755
index 0000000..2f7156a
--- /dev/null
+++ b/configs/tor/create-container.sh
@@ -0,0 +1,39 @@
+#!/bin/bash
+# Recreate koopa-tor-relay as non-root (uid 1000) under rootless podman keep-id.
+# Run as hernani on koopa (not root). Stops/removes existing container first.
+set -euo pipefail
+
+NAME=koopa-tor-relay
+IMAGE="${TOR_IMAGE:-localhost/koopa-tor-relay:latest}"
+BASE="${KOOPA_TOR_BASE:-$HOME/koopa-tor-relay}"
+
+if [[ ! -f "$BASE/torrc" ]]; then
+  echo "ERROR: missing $BASE/torrc" >&2
+  exit 1
+fi
+mkdir -p "$BASE/data" "$BASE/log"
+# Host ownership: hernani (uid 1000) ↔ container debian-tor (uid 1000) via keep-id
+chmod 700 "$BASE/data" 2>/dev/null || true
+
+if podman ps -a --format '{{.Names}}' | grep -qx "$NAME"; then
+  podman stop "$NAME" 2>/dev/null || true
+  podman rm "$NAME"
+fi
+
+podman create \
+  --name "$NAME" \
+  --replace \
+  --network host \
+  --user 1000:1000 \
+  --userns keep-id \
+  --restart unless-stopped \
+  -v "$BASE/torrc:/etc/tor/torrc:ro" \
+  -v "$BASE/data:/var/lib/tor:Z" \
+  -v "$BASE/log:/var/log/tor:Z" \
+  --label org.hacktivism.service=tor \
+  --label org.hacktivism.container=koopa-tor-relay \
+  --label org.hacktivism.managed_by=koopa-admin \
+  "$IMAGE"
+
+echo "created $NAME (user 1000:1000, userns=keep-id, host net)"
+echo "start: podman start $NAME   # or systemctl --user start container-koopa-tor-relay"
diff --git a/host/tor/README.md b/host/tor/README.md
index 9bf2e15..18643b5 100644
--- a/host/tor/README.md
+++ b/host/tor/README.md
@@ -1,8 +1,9 @@
 # Tor on koopa
 
 **Runtime:** podman **`koopa-tor-relay`** (not host `tor.service`).  
-**Config mirror:** `configs/tor/` (`torrc`, Containerfile, migrate script, user unit).  
-**Data/identity:** `~/koopa-tor-relay/data` (same keys as former `/var/lib/tor`).
+**Config mirror:** `configs/tor/` (`torrc`, Containerfile, migrate script, `create-container.sh`, user unit).  
+**Data/identity:** `~/koopa-tor-relay/data` (same keys as former `/var/lib/tor`).  
+**Process:** non-root **uid 1000** (`debian-tor`); recreate via `configs/tor/create-container.sh` after image rebuild.
 
 | Port | Bind | Role |
 |------|------|------|