Project XTLS https://github.com/XTLS/Xray-core https://xtls.github.io/en/
All variables are optional. Without WEBUI_PASS and with the default NET_MODE=off, the container behaves like a plain xray container: it runs /etc/xray/config.json as is.
| Variable | Default | Description |
|---|---|---|
WEBUI_PASS | — | Password for the web UI. Setting it enables the web UI and the managed mode: config validation before apply, automatic rollback, backups, in-memory log, adding servers by link, xrayctl. |
WEBUI_USER | admin | Web UI login. Allowed characters: A-Z a-z 0-9 _ . -. |
WEBUI_PORT | 8080 | Web UI port. Must not clash with xray inbound ports. The web UI listens on the container IP only. |
XRAY_LINK | — | Server link used to build the starter config when /etc/xray/config.json does not exist: vless://, vmess://, trojan://, ss://, hy2://, wg://. The starter config depends on NET_MODE (see below). Without a link, or with an invalid one, a fail-safe config is created and all traffic goes direct. Used only when the starter config is created. |
YOUTUBE_RU | false | true together with XRAY_LINK and XRAY_LINK_EU: the starter config splits servers into two groups — YouTube goes through proxy_ru-* servers, everything else through proxy_eu-*. Use it only if you really need to split traffic between RU and EU servers: without a server in the proxy_eu- group this scheme does not work (its traffic is not proxied). Ignored without XRAY_LINK_EU. |
XRAY_LINK_EU | — | Link to the first server of the proxy_eu- group, used with YOUTUBE_RU=true (the server from XRAY_LINK goes to proxy_ru-). Ignored without YOUTUBE_RU. |
NET_MODE | off | Container networking: off, tproxy or redir_tun (see below). |
NET_TUNE | true | Network tuning inside the container: TCP settings for long-lived connections (no slow start after idle, MTU probing, lower unsent buffer), fq_codel, multicast off — in any mode; conntrack timeouts — in tproxy / redir_tun only. false (0, no, off) disables it. |
GEODATA_UPDATE | true | Adds a geodata section to the starter config: xray updates geoip.dat and geosite.dat (Loyalsoldier/v2ray-rules-dat) daily at 04:00 container time via the direct outbound, without a restart; on failure the previous files are kept. false (0, no, off) leaves the section out. |
TZ | UTC | Container time zone, e.g. Europe/Moscow. Affects the geodata schedule and log timestamps. |
LOG_BUFFER_KB | 256 | Size of the in-memory log ring buffer in KB (web UI Logs tab, xrayctl logs). Nothing is written to disk. |
BACKUP_KEEP | 10 | Number of previously applied config versions kept in /etc/xray/.webui/backups/. |
NET_MODE)| Mode | What the container does | Starter config with XRAY_LINK |
|---|---|---|
off (default) | Nothing: no traffic interception. xray serves its own inbounds — clients (a browser extension, another proxy such as mihomo) connect to them directly. | Balancer template: SOCKS inbound socks-1_in on 0.0.0.0:10800 (no auth). |
tproxy | Transparent proxy for TCP+UDP of LAN devices via TProxy: nftables prerouting only, fwmark 1 → routing table 100 (local default dev lo); the fake-IP range 198.18.0.0/15 is not excluded. arm64 and RouterOS 7.21+ with nftables. | Fake-IP template: TProxy inbound tproxy-in on port 12345 (TCP+UDP) plus a backup SOCKS inbound socks-1_in on port 10800. |
redir_tun | Transparent proxy: Redirect for TCP, TUN for UDP. Used automatically if the router kernel lacks nf_tables / nft_tproxy while tproxy is requested. | Fake-IP template, with tproxy-in replaced by redirect-in (TCP, port 7892) and tun-in (UDP, device xray0, gateway 100.64.0.1/30). |
The network rules are built from the inbounds of the active config, so the ports above can be changed in config.json.
XRAY_LINK, any mode): SOCKS on port 10800, DNS 1.1.1.1 / 8.8.8.8 (IPv4 only), everything goes direct. In tproxy / redir_tun it also has the mode's inbound.off):
proxy-1_<protocol>-<transport>-<security>, e.g. proxy-1_vless-tcp-reality.proxy-: balancer_eu (leastLoad) for traffic, proxy-pool (random) for DNS queries sent through the proxy.burstObservatory checks the servers every minute. If none passes the check, traffic goes through the backup balancer proxy-any (all proxy-* servers, ignoring checks) instead of being blocked.8.8.8.8 / 1.1.1.1 are blocked.tproxy, redir_tun):
198.18.0.0/15: Russian domains and GitHub get real addresses from Yandex, everything else gets fake ones.fakedns, http, tls, quic) restores the domain of each connection; a fake address whose domain cannot be restored is blocked.More servers are added in the web UI (Servers tab, paste a link): they become proxy-2_…, proxy-3_… and are picked up by the balancers automatically — no routing changes needed.
| Container path | Purpose |
|---|---|
/etc/xray | Config directory (mount the whole directory, not a single file): config.json, plus .webui/ with the applied version and backups in managed mode. |
/usr/share/xray | (optional) Your own geoip.dat / geosite.dat. Both files must be present; otherwise the files bundled with the image are used. |
Content type
Image
Digest
sha256:0f468b27b…
Size
26.6 MB
Last updated
2 days ago
docker pull anvarsoft/mikrotik_xray-webui