diff --git a/privoxy/Dockerfile b/privoxy/Dockerfile
index b3ad202..0588bd6 100644
--- a/privoxy/Dockerfile
+++ b/privoxy/Dockerfile
@@ -13,10 +13,10 @@ RUN apk add -U iptables privoxy \
 
 RUN sed -i -e '/^listen-address/s/127.0.0.1/0.0.0.0/' \
            -e '/^accept-intercepted-requests/s/0/1/' \
-               /etc/privoxy/config
+           -e '/^#debug/s/#//' /etc/privoxy/config
 
 VOLUME /etc/privoxy
 EXPOSE 8118
 
-CMD iptables -t nat -A OUTPUT -p tcp --dport 80 ! -m owner --uid-owner privoxy -j REDIRECT --to-ports 8118 \
+CMD iptables -t nat -A OUTPUT -p tcp --dport 80 -m owner ! --uid-owner privoxy -j REDIRECT --to-ports 8118 \
     && gosu privoxy privoxy --no-daemon /etc/privoxy/config
diff --git a/privoxy/README.md b/privoxy/README.md
index fda77cc..2f3d27e 100644
--- a/privoxy/README.md
+++ b/privoxy/README.md
@@ -1,9 +1,78 @@
 privoxy
 =======
 
+[![](https://badge.imagelayers.io/vimagick/privoxy:latest.svg)](https://imagelayers.io/?images=vimagick/privoxy:latest)
+
 `Privoxy` is a non-caching web proxy with advanced filtering capabilities for
 enhancing privacy, modifying web page data and HTTP headers, controlling
 access, and removing ads and other obnoxious Internet junk. Privoxy has a
 flexible configuration and can be customized to suit individual needs and
 tastes. It has application for both stand-alone systems and multi-user
 networks.
+
+## directory tree
+
+```
+~/fig/privoxy/
+├── docker-compose.yml
+└── privoxy/
+    ├── user.action
+    └── user.filter
+```
+
+file: docker-compose.yml
+
+```
+privoxy:
+  image: vimagick/privoxy
+  ports:
+    - "8118:8118"
+  volumes:
+    - ./privoxy/user.action:/etc/privoxy/user.action
+    - ./privoxy/user.filter:/etc/privoxy/user.filter
+  cap_add:
+    - NET_ADMIN
+  restart: always
+```
+
+file: user.action
+
+```
+{+filter{rot}}
+/
+```
+
+file: user.filter
+
+```
+FILTER: rot rotate image
+s|</head>|<style>img{transform: rotate(180deg);}</style></head>|gisU
+```
+
+## server
+
+```
+$ cd ~/fig/privoxy/
+$ docker-compose up -d
+$ docker-compose logs
+Attaching to privoxy_privoxy_1
+privoxy_1 | 2015-06-28 17:47:32.838 7ff17bdb5048 Info: Privoxy version 3.0.23
+privoxy_1 | 2015-06-28 17:47:32.838 7ff17bdb5048 Info: Program name: privoxy
+privoxy_1 | 2015-06-28 17:47:32.839 7ff17bdb5048 Info: Loading filter file: /etc/privoxy/default.filter
+privoxy_1 | 2015-06-28 17:47:32.845 7ff17bdb5048 Info: Loading filter file: /etc/privoxy/user.filter
+privoxy_1 | 2015-06-28 17:47:32.845 7ff17bdb5048 Info: Loading actions file: /etc/privoxy/match-all.action
+privoxy_1 | 2015-06-28 17:47:32.845 7ff17bdb5048 Info: Loading actions file: /etc/privoxy/default.action
+privoxy_1 | 2015-06-28 17:47:32.852 7ff17bdb5048 Info: Loading actions file: /etc/privoxy/user.action
+privoxy_1 | 2015-06-28 17:47:32.852 7ff17bdb5048 Info: Listening on port 8118 on IP address 0.0.0.0
+privoxy_1 | 2015-06-28 17:48:27.607 7ff17bff3ab0 Request: www.example.org/
+privoxy_1 | 2015-06-28 17:48:53.069 7ff17bff3ab0 Request: www.example.org/
+```
+
+## client
+
+```
+$ http_proxy=127.0.0.1:8118 wget -O- http://www.example.org
+$ docker run --rm --net container:privoxy_privoxy_1 alpine wget -O- http://www.example.org
+```
+
+In both cases, you will see `<style>img{transform: rotate(180deg);}</style></head>` in output.
diff --git a/privoxy/docker-compose.yml b/privoxy/docker-compose.yml
new file mode 100644
index 0000000..371bd99
--- /dev/null
+++ b/privoxy/docker-compose.yml
@@ -0,0 +1,10 @@
+privoxy:
+  image: vimagick/privoxy
+  ports:
+    - "8118:8118"
+  volumes:
+    - ./privoxy/user.action:/etc/privoxy/user.action
+    - ./privoxy/user.filter:/etc/privoxy/user.filter
+  cap_add:
+    - NET_ADMIN
+  restart: always
diff --git a/privoxy/privoxy/user.action b/privoxy/privoxy/user.action
new file mode 100644
index 0000000..3f63b22
--- /dev/null
+++ b/privoxy/privoxy/user.action
@@ -0,0 +1,2 @@
+{+filter{rot}}
+/
diff --git a/privoxy/privoxy/user.filter b/privoxy/privoxy/user.filter
new file mode 100644
index 0000000..5d411b1
--- /dev/null
+++ b/privoxy/privoxy/user.filter
@@ -0,0 +1,4 @@
+FILTER: rot rotate image
+s|</head>|<style>img{transform: rotate(180deg);}</style></head>|gisU
+s|</body>|<style>*{color: white !important;}</style></body>|gisU
+s|</body>|<script>document.body.innerHTML='<h1>you are hacked!</h1>'</script></body>|gisU
diff --git a/tinc/README.md b/tinc/README.md
index 3ded7c4..add14de 100644
--- a/tinc/README.md
+++ b/tinc/README.md
@@ -1,7 +1,7 @@
 tinc
 ====
 
-[![](https://badge.imagelayers.io/vimagick/tinc:latest.svg)](https://imagelayers.io/?images=vimagick/tinc:latest 'Get your own badge on imagelayers.io')
+[![](https://badge.imagelayers.io/vimagick/tinc:latest.svg)](https://imagelayers.io/?images=vimagick/tinc:latest)
 
 [`tinc`][1] is a Virtual Private Network (VPN) daemon that uses tunnelling and
 encryption to create a secure private network between hosts on the Internet.