taoziyoyo2566/xray-docker repository overview

⁠Xray

Xray-core⁠ for linux/amd64 and linux/arm64, about 25 MB compressed. Built from the official release assets with their SHA256 digests verified, and run on both architectures before any tag is created.

⁠Run

docker run -d --name xray --restart unless-stopped \
  -v ./config.json:/config.json:ro \
  -p 443:443 \
  taoziyoyo2566/xray-docker:latest

The image ships no configuration — mount your own. It is validated before Xray starts, so a broken config exits with the parser error instead of restarting forever.

Runs as UID 10000, and works with --read-only, --cap-drop ALL and --security-opt no-new-privileges.

⁠Split configuration

Mount a directory of JSON fragments at /etc/xray/conf.d instead of one file. Xray merges them in filename order, but not symmetrically:

Check the merged result before deploying:

docker run --rm -v ./conf.d:/etc/xray/conf.d:ro \
  --entrypoint /usr/bin/xray taoziyoyo2566/xray-docker:latest \
  run -confdir /etc/xray/conf.d -dump

Full rules: Xray multiple-config documentation⁠.

⁠Tags and updates

New upstream releases appear automatically, usually within a day. Old tags are kept, never deleted.

No tag is immutable — not even vX.Y.Z. A version tag names an upstream Xray version, not a fixed set of bytes: when the image definition changes (a base image security update, a packaging fix) the tag is rebuilt and re-pointed. That is how a CVE fix reaches you without your chasing a new version number, and the trade-off is that a tag alone does not pin content.

To take updates, pull and recreate — the tag you already use will have moved:

docker pull taoziyoyo2566/xray-docker:latest
docker rm -f xray && docker run -d --name xray ...   # same flags as above

To pin content instead, use a digest — those never change, and never receive updates until you move the pin yourself:

docker run -d taoziyoyo2566/xray-docker@sha256:...

⁠Rule data

geoip.dat and geosite.dat ship at /usr/local/share/xray, so geoip: and geosite: routing rules work out of the box. They are the copies bundled in the official Xray release — a snapshot from that release date, never refreshed in place — packaged by Loyalsoldier/v2ray-rules-dat⁠, which carries extra categories beyond the v2fly originals. Mount your own directory over /usr/local/share/xray for current or different data.

⁠Licenses

The image bundles third-party components under several licenses. Full statement: THIRD-PARTY-NOTICES.md⁠; a NOTICE and the license texts also ship at /usr/share/licenses/ inside the image.

• Xray-core — MPL-2.0, redistributed unmodified.
• geoip.dat, geosite.dat — from v2ray-rules-dat (GPL-3.0-only); geosite.dat derives from v2fly/domain-list-community⁠ (MIT), geoip.dat from MaxMind's GeoLite2 Country database.

Build tooling: taoziyoyo2566/xray-docker⁠, MIT — the tooling only, not the bundled components above.